Loading ...

Play interactive tourEdit tour

Analysis Report sviluppo_economico_18__257.xls

Overview

General Information

Sample Name:sviluppo_economico_18__257.xls
Analysis ID:321050
MD5:497b53c6668e127364bc30f56555399b
SHA1:ae46204ffd41a649ce4fb9ab24e0add934b68549
SHA256:f07973faea77882d308d04ea19d66110e3ed3e65c2b8acc45fb6e6fffb5180f4

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:20
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Yara detected password protected xls with embedded macros
Unable to load, office file is protected or invalid

Classification

Startup

  • System is w10x64
  • EXCEL.EXE (PID: 4156 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
sviluppo_economico_18__257.xlsJoeSecurity_PasswordProtectedXlsWithEmbeddedMacrosYara detected password protected xls with embedded macrosJoe Security

    Sigma Overview

    No Sigma rule has matched

    Signature Overview

    Click to jump to signature section

    Show All Signature Results
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://api.aadrm.com/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://api.diagnostics.office.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://api.microsoftstream.com/api/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://api.office.net
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://api.onedrive.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://apis.live.net/v5.0/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://augloop.office.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://augloop.office.com/v2
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://autodiscover-s.outlook.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://cdn.entity.
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://clients.config.office.net/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://config.edge.skype.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://cortana.ai
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://cr.office.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://dataservice.o365filtering.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://dataservice.o365filtering.com/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://devnull.onenote.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://directory.services.
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://graph.ppe.windows.net
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://graph.ppe.windows.net/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://graph.windows.net
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://graph.windows.net/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://incidents.diagnostics.office.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://lifecycle.office.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://login.microsoftonline.com/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://login.windows.local
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://management.azure.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://management.azure.com/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://messaging.office.com/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://ncus-000.contentsync.
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://ncus-000.pagecontentsync.
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://officeapps.live.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://onedrive.live.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://onedrive.live.com/embed?
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://outlook.office.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://outlook.office365.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://powerlift.acompli.net
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://settings.outlook.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://shell.suite.office.com:1443
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://skyapi.live.net/Activity/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://store.office.cn/addinstemplate
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://store.office.com/?productgroup=Outlook
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://store.office.com/addinstemplate
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://store.office.de/addinstemplate
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://tasks.office.com
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://templatelogging.office.com/client/log
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://web.microsoftstream.com/video/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://wus2-000.contentsync.
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://wus2-000.pagecontentsync.
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
    Source: AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drString found in binary or memory: https://www.odwebp.svc.ms
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEWindow title found: password 12
    Source: classification engineClassification label: sus20.expl.winXLS@1/1@0/0
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{7122A36C-AFF4-4A09-88CB-437F9D91A44C} - OProcSessId.datJump to behavior
    Source: sviluppo_economico_18__257.xlsOLE indicator, Workbook stream: true
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
    Source: sviluppo_economico_18__257.xlsInitial sample: OLE indicators vbamacros = False
    Source: sviluppo_economico_18__257.xlsInitial sample: OLE indicators encrypted = True
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior

    HIPS / PFW / Operating System Protection Evasion:

    barindex
    Yara detected password protected xls with embedded macrosShow sources
    Source: Yara matchFile source: sviluppo_economico_18__257.xls, type: SAMPLE

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionMasquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemorySystem Information Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    sviluppo_economico_18__257.xls6%VirustotalBrowse

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://cdn.entity.0%URL Reputationsafe
    https://wus2-000.contentsync.0%URL Reputationsafe
    https://wus2-000.contentsync.0%URL Reputationsafe
    https://wus2-000.contentsync.0%URL Reputationsafe
    https://wus2-000.contentsync.0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://powerlift.acompli.net0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://cortana.ai0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://ofcrecsvcapi-int.azurewebsites.net/0%VirustotalBrowse
    https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
    https://officeci.azurewebsites.net/api/0%VirustotalBrowse
    https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    https://wus2-000.pagecontentsync.0%URL Reputationsafe
    https://wus2-000.pagecontentsync.0%URL Reputationsafe
    https://wus2-000.pagecontentsync.0%URL Reputationsafe
    https://wus2-000.pagecontentsync.0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://dataservice.o365filtering.com/0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://apis.live.net/v5.0/0%URL Reputationsafe
    https://asgsmsproxyapi.azurewebsites.net/0%VirustotalBrowse
    https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
    https://ncus-000.contentsync.0%URL Reputationsafe
    https://ncus-000.contentsync.0%URL Reputationsafe
    https://ncus-000.contentsync.0%URL Reputationsafe
    https://ncus-000.contentsync.0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://dataservice.o365filtering.com0%URL Reputationsafe
    https://ovisualuiapp.azurewebsites.net/pbiagave/0%VirustotalBrowse
    https://ovisualuiapp.azurewebsites.net/pbiagave/0%Avira URL Cloudsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe
    https://directory.services.0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://api.diagnosticssdf.office.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
      high
      https://login.microsoftonline.com/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
        high
        https://shell.suite.office.com:1443AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
          high
          https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
            high
            https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
              high
              https://cdn.entity.AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              unknown
              https://api.addins.omex.office.net/appinfo/queryAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                high
                https://wus2-000.contentsync.AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                unknown
                https://clients.config.office.net/user/v1.0/tenantassociationkeyAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                  high
                  https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                    high
                    https://powerlift.acompli.netAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://rpsticket.partnerservices.getmicrosoftkey.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://lookup.onenote.com/lookup/geolocation/v1AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                      high
                      https://cortana.aiAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                        high
                        https://cloudfiles.onenote.com/upload.aspxAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                          high
                          https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                            high
                            https://entitlement.diagnosticssdf.office.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                              high
                              https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicyAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                high
                                https://api.aadrm.com/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                https://ofcrecsvcapi-int.azurewebsites.net/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                • 0%, Virustotal, Browse
                                • Avira URL Cloud: safe
                                unknown
                                https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                  high
                                  https://api.microsoftstream.com/api/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                    high
                                    https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                      high
                                      https://cr.office.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                        high
                                        https://portal.office.com/account/?ref=ClientMeControlAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                          high
                                          https://ecs.office.com/config/v2/OfficeAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                            high
                                            https://graph.ppe.windows.netAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                              high
                                              https://res.getmicrosoftkey.com/api/redemptioneventsAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              unknown
                                              https://powerlift-frontdesk.acompli.netAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              unknown
                                              https://tasks.office.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                high
                                                https://officeci.azurewebsites.net/api/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                • 0%, Virustotal, Browse
                                                • Avira URL Cloud: safe
                                                unknown
                                                https://sr.outlook.office.net/ws/speech/recognize/assistant/workAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                  high
                                                  https://store.office.cn/addinstemplateAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://wus2-000.pagecontentsync.AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://outlook.office.com/autosuggest/api/v1/init?cvid=AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                    high
                                                    https://globaldisco.crm.dynamics.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                      high
                                                      https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                        high
                                                        https://store.officeppe.com/addinstemplateAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://dev0-api.acompli.net/autodetectAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://www.odwebp.svc.msAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://api.powerbi.com/v1.0/myorg/groupsAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                          high
                                                          https://web.microsoftstream.com/video/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                            high
                                                            https://graph.windows.netAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                              high
                                                              https://dataservice.o365filtering.com/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://officesetup.getmicrosoftkey.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://analysis.windows.net/powerbi/apiAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                high
                                                                https://prod-global-autodetect.acompli.net/autodetectAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://outlook.office365.com/autodiscover/autodiscover.jsonAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                  high
                                                                  https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                    high
                                                                    https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                      high
                                                                      https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                        high
                                                                        https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                          high
                                                                          https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                            high
                                                                            http://weather.service.msn.com/data.aspxAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                              high
                                                                              https://apis.live.net/v5.0/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              • URL Reputation: safe
                                                                              unknown
                                                                              https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                high
                                                                                https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                  high
                                                                                  https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                    high
                                                                                    https://management.azure.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                      high
                                                                                      https://outlook.office365.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                        high
                                                                                        https://incidents.diagnostics.office.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                          high
                                                                                          https://clients.config.office.net/user/v1.0/iosAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                            high
                                                                                            https://insertmedia.bing.office.net/odc/insertmediaAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                              high
                                                                                              https://o365auditrealtimeingestion.manage.office.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                high
                                                                                                https://outlook.office365.com/api/v1.0/me/ActivitiesAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                  high
                                                                                                  https://api.office.netAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                    high
                                                                                                    https://incidents.diagnosticssdf.office.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                      high
                                                                                                      https://asgsmsproxyapi.azurewebsites.net/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                      • 0%, Virustotal, Browse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      unknown
                                                                                                      https://clients.config.office.net/user/v1.0/android/policiesAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                        high
                                                                                                        https://entitlement.diagnostics.office.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                          high
                                                                                                          https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                            high
                                                                                                            https://autodiscover-s.outlook.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                              high
                                                                                                              https://storage.live.com/clientlogs/uploadlocationAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                high
                                                                                                                https://templatelogging.office.com/client/logAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                  high
                                                                                                                  https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                    high
                                                                                                                    https://management.azure.com/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                      high
                                                                                                                      https://ncus-000.contentsync.AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                      • URL Reputation: safe
                                                                                                                      • URL Reputation: safe
                                                                                                                      • URL Reputation: safe
                                                                                                                      • URL Reputation: safe
                                                                                                                      unknown
                                                                                                                      https://login.windows.net/common/oauth2/authorizeAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                        high
                                                                                                                        https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFileAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                        • URL Reputation: safe
                                                                                                                        • URL Reputation: safe
                                                                                                                        • URL Reputation: safe
                                                                                                                        • URL Reputation: safe
                                                                                                                        unknown
                                                                                                                        https://graph.windows.net/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                          high
                                                                                                                          https://api.powerbi.com/beta/myorg/importsAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                            high
                                                                                                                            https://devnull.onenote.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                              high
                                                                                                                              https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.jsonAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                high
                                                                                                                                https://messaging.office.com/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                  high
                                                                                                                                  https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://augloop.office.com/v2AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                      high
                                                                                                                                      https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=BingAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                        high
                                                                                                                                        https://skyapi.live.net/Activity/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        unknown
                                                                                                                                        https://clients.config.office.net/user/v1.0/macAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                          high
                                                                                                                                          https://dataservice.o365filtering.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          unknown
                                                                                                                                          https://onedrive.live.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                            high
                                                                                                                                            https://ovisualuiapp.azurewebsites.net/pbiagave/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                            • 0%, Virustotal, Browse
                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                            unknown
                                                                                                                                            https://visio.uservoice.com/forums/368202-visio-on-devicesAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://directory.services.AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              unknown
                                                                                                                                              https://login.windows-ppe.net/common/oauth2/authorizeAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                                high
                                                                                                                                                https://loki.delve.office.com/api/v1/configuration/officewin32/AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                                  high
                                                                                                                                                  https://onedrive.live.com/embed?AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                                    high
                                                                                                                                                    https://augloop.office.comAC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                                      high
                                                                                                                                                      https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B.0.drfalse
                                                                                                                                                        high

                                                                                                                                                        Contacted IPs

                                                                                                                                                        No contacted IP infos

                                                                                                                                                        General Information

                                                                                                                                                        Joe Sandbox Version:31.0.0 Red Diamond
                                                                                                                                                        Analysis ID:321050
                                                                                                                                                        Start date:20.11.2020
                                                                                                                                                        Start time:10:26:32
                                                                                                                                                        Joe Sandbox Product:CloudBasic
                                                                                                                                                        Overall analysis duration:0h 4m 8s
                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                        Report type:full
                                                                                                                                                        Sample file name:sviluppo_economico_18__257.xls
                                                                                                                                                        Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                        Run name:Potential for more IOCs and behavior
                                                                                                                                                        Number of analysed new started processes analysed:21
                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                        Technologies:
                                                                                                                                                        • HCA enabled
                                                                                                                                                        • EGA enabled
                                                                                                                                                        • HDC enabled
                                                                                                                                                        • AMSI enabled
                                                                                                                                                        Analysis Mode:default
                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                        Detection:SUS
                                                                                                                                                        Classification:sus20.expl.winXLS@1/1@0/0
                                                                                                                                                        Cookbook Comments:
                                                                                                                                                        • Adjust boot time
                                                                                                                                                        • Enable AMSI
                                                                                                                                                        • Found application associated with file extension: .xls
                                                                                                                                                        • Changed system and user locale, location and keyboard layout to Italian - Italy
                                                                                                                                                        • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                        • Attach to Office via COM
                                                                                                                                                        • Scroll down
                                                                                                                                                        • Close Viewer
                                                                                                                                                        Warnings:
                                                                                                                                                        Show All
                                                                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 40.88.32.150, 104.42.151.234, 52.109.32.27, 52.109.88.39, 52.109.8.23, 23.210.248.85, 51.104.144.132, 205.185.216.42, 205.185.216.10, 20.54.26.129, 104.43.139.144, 51.11.168.160, 95.101.22.134, 95.101.22.125
                                                                                                                                                        • Excluded domains from analysis (whitelisted): prod-w.nexus.live.com.akadns.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, nexus.officeapps.live.com, officeclient.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, db3p-ris-pf-prod-atm.trafficmanager.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, skypedataprdcolcus16.cloudapp.net, ris.api.iris.microsoft.com, umwatsonrouting.trafficmanager.net, config.officeapps.live.com, skypedataprdcolwus16.cloudapp.net, europe.configsvc1.live.com.akadns.net

                                                                                                                                                        Simulations

                                                                                                                                                        Behavior and APIs

                                                                                                                                                        No simulations

                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                        IPs

                                                                                                                                                        No context

                                                                                                                                                        Domains

                                                                                                                                                        No context

                                                                                                                                                        ASN

                                                                                                                                                        No context

                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                        No context

                                                                                                                                                        Dropped Files

                                                                                                                                                        No context

                                                                                                                                                        Created / dropped Files

                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\AC42BFC9-8440-46A9-BF44-EB2CB8D5BA2B
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):129952
                                                                                                                                                        Entropy (8bit):5.378335030279484
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:1536:7cQceNWiA3gZwLpQ9DQW+zAUH34ZldpKWXboOilXPErLL8TT:pmQ9DQW+zBX8u
                                                                                                                                                        MD5:DCB47E168C66B597A4A3AD88A0DFC606
                                                                                                                                                        SHA1:ECFC2F0651D274BF1E644D085E9C52313BE674DA
                                                                                                                                                        SHA-256:51D53E177B926C0B90AE56DD2CBA71420E882B74DA62228FA488E0BEE65FBC1F
                                                                                                                                                        SHA-512:CF9C84881631D6D6D0324253BA3787B7E416F2EE67858A5A0EE3B9FA03AB1EC7FC9CD7FE4F8EC6FDB2841EBE60D29EC4D41B02C641EE9E2AE3F9375CF50A913B
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:low
                                                                                                                                                        Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2020-11-20T09:27:35">.. Build: 16.0.13518.30530-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

                                                                                                                                                        Static File Info

                                                                                                                                                        General

                                                                                                                                                        File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: veeREfBOcKbNRq, Last Saved By: administrator, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Nov 18 21:59:48 2020, Last Saved Time/Date: Wed Nov 18 22:46:55 2020, Security: 1
                                                                                                                                                        Entropy (8bit):7.657541825457614
                                                                                                                                                        TrID:
                                                                                                                                                        • Microsoft Excel sheet (30009/1) 78.94%
                                                                                                                                                        • Generic OLE2 / Multistream Compound File (8008/1) 21.06%
                                                                                                                                                        File name:sviluppo_economico_18__257.xls
                                                                                                                                                        File size:406528
                                                                                                                                                        MD5:497b53c6668e127364bc30f56555399b
                                                                                                                                                        SHA1:ae46204ffd41a649ce4fb9ab24e0add934b68549
                                                                                                                                                        SHA256:f07973faea77882d308d04ea19d66110e3ed3e65c2b8acc45fb6e6fffb5180f4
                                                                                                                                                        SHA512:92e760cbf9ac4bcbfeecf232b6c4f3dbddf0e7287e9795e410f68bfea0e0c7e7739d48d5bebab0a1c9e09aa442658c7d406cb586e9dc0f02c0a8227c5f66d1c2
                                                                                                                                                        SSDEEP:6144:io0aQoiZJoBOKsuHzGNpT6rLh/s7UpT2ETflvilcMSvcseT8O:1wZ6BOKseGNgfa7ET8SvmH
                                                                                                                                                        File Content Preview:........................>......................................................................................................................................................................................................................................

                                                                                                                                                        File Icon

                                                                                                                                                        Icon Hash:74ecd4c6c3c6c4d8

                                                                                                                                                        Static OLE Info

                                                                                                                                                        General

                                                                                                                                                        Document Type:OLE
                                                                                                                                                        Number of OLE Files:1

                                                                                                                                                        OLE File "sviluppo_economico_18__257.xls"

                                                                                                                                                        Indicators

                                                                                                                                                        Has Summary Info:True
                                                                                                                                                        Application Name:Microsoft Excel
                                                                                                                                                        Encrypted Document:True
                                                                                                                                                        Contains Word Document Stream:False
                                                                                                                                                        Contains Workbook/Book Stream:True
                                                                                                                                                        Contains PowerPoint Document Stream:False
                                                                                                                                                        Contains Visio Document Stream:False
                                                                                                                                                        Contains ObjectPool Stream:
                                                                                                                                                        Flash Objects Count:
                                                                                                                                                        Contains VBA Macros:False

                                                                                                                                                        Summary

                                                                                                                                                        Code Page:1252
                                                                                                                                                        Author:veeREfBOcKbNRq
                                                                                                                                                        Last Saved By:administrator
                                                                                                                                                        Create Time:2020-11-18 21:59:48
                                                                                                                                                        Last Saved Time:2020-11-18 22:46:55
                                                                                                                                                        Creating Application:Microsoft Excel
                                                                                                                                                        Security:1

                                                                                                                                                        Document Summary

                                                                                                                                                        Document Code Page:1252
                                                                                                                                                        Thumbnail Scaling Desired:False
                                                                                                                                                        Company:
                                                                                                                                                        Contains Dirty Links:False
                                                                                                                                                        Shared Document:False
                                                                                                                                                        Changed Hyperlinks:False
                                                                                                                                                        Application Version:1048576

                                                                                                                                                        Streams

                                                                                                                                                        Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                        General
                                                                                                                                                        Stream Path:\x5DocumentSummaryInformation
                                                                                                                                                        File Type:data
                                                                                                                                                        Stream Size:4096
                                                                                                                                                        Entropy:0.749350878342
                                                                                                                                                        Base64 Encoded:False
                                                                                                                                                        Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F o g l i o 1 . . . . . F o g l i o 2 . . . . . F o g l i o 3 . . . . . F o g l i o 4 . . . . . t X C l h W q g
                                                                                                                                                        Data Raw:fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 0c 02 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 be 01 00 00
                                                                                                                                                        Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                        General
                                                                                                                                                        Stream Path:\x5SummaryInformation
                                                                                                                                                        File Type:data
                                                                                                                                                        Stream Size:4096
                                                                                                                                                        Entropy:0.330245496252
                                                                                                                                                        Base64 Encoded:False
                                                                                                                                                        Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v e e R E f B O c K b N R q . . . . . . . . . . a d m i n i s t r a t o r . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . b . ! . . . . @ . . . . Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                                                                                                        Data Raw:fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 b0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 60 00 00 00 12 00 00 00 78 00 00 00 0c 00 00 00 90 00 00 00 0d 00 00 00 9c 00 00 00 13 00 00 00 a8 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 10 00 00 00
                                                                                                                                                        Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 393436
                                                                                                                                                        General
                                                                                                                                                        Stream Path:Workbook
                                                                                                                                                        File Type:Applesoft BASIC program data, first line number 16
                                                                                                                                                        Stream Size:393436
                                                                                                                                                        Entropy:7.75690503676
                                                                                                                                                        Base64 Encoded:True
                                                                                                                                                        Data ASCII:. . . . . . . . Z O . . . . . . . . . . / . . . . . . . . . . . . . ~ . . . . . . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . M . i . c . r . o . s . o . f . t . . E . n . h . a . n . c . e . d . . C . r . y . p . t . o . g . r . a . p . h . i . c . . P . r . o . v . i . d . e . r . . v . 1 . . . 0 . . . . . . . % . . . C . . P . . . . . h ; ~ . < ) . X . . . 9 . , # . . . . . . . . . v / . 4 . . . . . . . . . . y . . I . . . . . . . . . . . . . . . . . \\ . p . 5 . R . B @ . . . . . .
                                                                                                                                                        Data Raw:09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 2f 00 c8 00 01 00 04 00 02 00 0c 00 00 00 7e 00 00 00 0c 00 00 00 00 00 00 00 01 68 00 00 04 80 00 00 80 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 45 00 6e 00 68 00 61 00 6e 00 63 00 65 00 64 00 20 00 43 00 72 00 79 00 70 00 74 00 6f 00 67 00 72 00 61 00 70 00

                                                                                                                                                        Network Behavior

                                                                                                                                                        Network Port Distribution

                                                                                                                                                        UDP Packets

                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                        Nov 20, 2020 10:27:20.820866108 CET6418553192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:20.847958088 CET53641858.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:21.478976965 CET6511053192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:21.506289959 CET53651108.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:23.817430019 CET5836153192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:23.853261948 CET53583618.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:24.890496016 CET6349253192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:24.926238060 CET53634928.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:26.118782043 CET6083153192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:26.145806074 CET53608318.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:35.239835978 CET6010053192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:35.279100895 CET53601008.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:35.571603060 CET5319553192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:35.638370991 CET53531958.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:36.581835985 CET5319553192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:36.618887901 CET53531958.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:37.585036039 CET5319553192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:37.620615959 CET53531958.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:39.582700968 CET5319553192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:39.620450974 CET53531958.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:40.617322922 CET5014153192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:40.644412994 CET53501418.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:43.598619938 CET5319553192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:43.636204004 CET53531958.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:46.419555902 CET5302353192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:46.446671963 CET53530238.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:48.327178001 CET4956353192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:48.354605913 CET53495638.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:49.325272083 CET5135253192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:49.352189064 CET53513528.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:49.804657936 CET5934953192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:49.843851089 CET53593498.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:27:50.169934034 CET5708453192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:27:50.197022915 CET53570848.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:28:00.867996931 CET5882353192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:28:00.894996881 CET53588238.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:28:01.959742069 CET5756853192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:28:01.986718893 CET53575688.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:28:03.156800032 CET5054053192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:28:03.183762074 CET53505408.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:28:07.912851095 CET5436653192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:28:07.939990044 CET53543668.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:28:09.216999054 CET5303453192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:28:09.252787113 CET53530348.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:28:12.365748882 CET5776253192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:28:12.392900944 CET53577628.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:28:13.192749023 CET5543553192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:28:13.228507042 CET53554358.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:28:24.735367060 CET5071353192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:28:24.762434006 CET53507138.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:28:29.796464920 CET5613253192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:28:29.833558083 CET53561328.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:28:59.741245985 CET5898753192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:28:59.768280029 CET53589878.8.8.8192.168.2.3
                                                                                                                                                        Nov 20, 2020 10:29:01.941852093 CET5657953192.168.2.38.8.8.8
                                                                                                                                                        Nov 20, 2020 10:29:01.985625982 CET53565798.8.8.8192.168.2.3

                                                                                                                                                        Code Manipulations

                                                                                                                                                        Statistics

                                                                                                                                                        CPU Usage

                                                                                                                                                        Click to jump to process

                                                                                                                                                        Memory Usage

                                                                                                                                                        Click to jump to process

                                                                                                                                                        System Behavior

                                                                                                                                                        General

                                                                                                                                                        Start time:10:27:33
                                                                                                                                                        Start date:20/11/2020
                                                                                                                                                        Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                        Imagebase:0xb90000
                                                                                                                                                        File size:27110184 bytes
                                                                                                                                                        MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        Disassembly

                                                                                                                                                        Reset < >