[waffles2.0]

In this blog post by Qihoo 360 they document CVE-2018-5002: http://blogs.360.cn/blog/cve-2018-5002-en/

It seems like they are the only people who have reversed it, unfortunately they have decided to hide a section of the MD5s

***salary.xlsx - MD5: ******517277fb0dbb4bbf724245e663
malicious SWF (Shock Wave File) file - MD5: ******66491a5c5cd7423849f32b58f5
decrypted SWF - md5: ******e78116bebfa1780736d343c9eb

Has anyone found more information or has access to the decrypted Shockwave file that contains the exploit?
Thanks.

[maddog4012]

here is the XLS this also has some additional dropped files files collected from the sandbox

[waffles2.0]

Thanks maddog! It's too bad the C2 server is down now so we can't get the SWF files.

[xors]

swf