← Reports

Malicious Macros in Office Documents

Claim_732989680_03292021.xlsm

Author
Moise Medici
Updated
25 Oct 2025 · Completed
Difficulty
Easy
Platform
Windows
Languages
VBAExcel 4.0 Macro
MITRE
T1059 (Command and Scripting Interpreter) T1059.005 (Command and Scripting Interpreter: Visual Basic) T1106 (Native API) T1204.002 (User Execution: Malicious File) T1027.010 (Obfuscated Files or Information: Command Obfuscation) T1218.011 (System Binary Proxy Execution: Rundll32) T1564 (Hide Artifacts) T1071.001 (Application Layer Protocol: Web Protocols) T1105 (Ingress Tool Transfer)

Indicators of Compromise

Network
http://45.150.67.232/44283,9203350694.dat
http://45.150.67.234/44283,9203350694.dat
http://195.123.210.162/44283,9203350694.dat
Files
Hodas.vyur
Hodas.vyur1
Hodas.vyur2