Analysis Report Fennec Pharma.xlsx

Overview

General Information

Sample Name:	Fennec Pharma.xlsx
Analysis ID:	321368
MD5:	a2315b66552273d966bdc8570a6a7208
SHA1:	ad82640b54ce17f43e9df68ebfa700de48df5ef0
SHA256:	8c3a18ce48dbab7971870da260421c03483e279795768bfdeb0ee7dd6079ec2b
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected HtmlPhish_10

Phishing site detected (based on image similarity)

Phishing site detected (based on logo template match)

HTML body contains low number of good links

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Classification

Signatures

AV Detection:

Antivirus detection for URL or domain

Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish_10

Source: Yara match	File source: 305090.3.links.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\dfce06801e1a85d6d06f1fdd4475dacd[1].htm, type: DROPPED

Phishing site detected (based on image similarity)

Source: https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/rC56cpX1uS2qJKOxJ-5Sb8u-.svg

Matcher: Found strong image similarity, brand: Microsoft

Jump to dropped file

Phishing site detected (based on logo template match)

Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html

Matcher: Template: microsoft matched

HTML body contains low number of good links

Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: Number of links: 0
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: Title: Log-In does not match URL
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: Title: Log-In does not match URL

Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: No <meta name="author".. found
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: No <meta name="author".. found
Source: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="author".. found
Source: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="author".. found
Source: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="author".. found
Source: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="author".. found

Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: No <meta name="copyright".. found
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: No <meta name="copyright".. found
Source: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="copyright".. found
Source: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="copyright".. found
Source: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="copyright".. found
Source: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="copyright".. found

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 74.125.140.154 74.125.140.154
Source: Joe Sandbox View	IP Address: 104.16.19.94 104.16.19.94

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7187B60E.png

Jump to behavior

Source: document_view.min[1].js.3.dr

String found in binary or memory: re glad you like WorkFlowy. Please share it with your friends!"),!c.d()&&o.createElement(o.Fragment,null,o.createElement("div",{className:Object(l.e)({marginBottom:"24px",lineHeight:"20px",fontSize:"13px"})},o.createElement("strong",null,"When a friend signs up through your Facebook post, we'll give you"," ",s===d?"both "+s+" more monthly items.":s+" more monthly items."+(d?" They'll get "+d+" more items too.":""))," ","You currently have ",i," WorkFlowy items per month.")),o.createElement(a.b,{buttonStyle:a.a.Primary,onClick:function(){var e=f+"&utm_campaign=friend_recommendation_prompt_10_days&utm_medium=facebook&utm_source=wf";window.open("https://www.facebook.com/sharer/sharer.php?u="+e,"Share WorkFlowy","height=640,width=558,left=50,top=50"),_gaq.push(["_trackPageview","/virtual/friend_recommendation_prompt/10_days/facebook_share_button_clicked"])}},"Share WorkFlowy on Facebook")))}},t}return d(t,e),t.prototype.componentWillUnount=function(){_gaq.push(["_trackPageview","/virtual/friend_recommendation_prompt/10_days/rating_dialog_closed/"])},t.prototype.render=function(){return o.createElement(o.Fragment,null,o.createElement(u.b,null,"What do you think of WorkFlowy?"),o.createElement("div",{className:Object(l.e)({marginTop:"24px",marginBottom:"24px"})},"Please click a star to rate WorkFlowy."),o.createElement(p,{onChange:this.onRatingChange}),o.createElement("div",{className:Object(l.e)({marginTop:"24px",marginBottom:"12px",fontSize:"13px",lineHeight:"20px"})},"You equals www.facebook.com (Facebook)

Source: unknown

DNS traffic detected: queries for: workflowy.com

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A.3.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F8008506.3.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: document_view.min[1].js.3.dr	String found in binary or memory: http://getfirefox.com
Source: document_view.min[1].js.3.dr	String found in binary or memory: http://google.com/chrome
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: http://jquery.org/license
Source: popper.min[1].js.3.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: ga[1].js.3.dr	String found in binary or memory: http://www.google-analytics.com
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=378607
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=449857
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=470258
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.jquery.com/ticket/12359
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.jquery.com/ticket/13378
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=137337
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#resolved-values
Source: free-fa-regular-400[1].eot.3.dr, free.min[1].css.3.dr	String found in binary or memory: https://fontawesome.com
Source: free.min[1].css.3.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: free-fa-regular-400[1].eot.3.dr, free-fa-solid-900[1].eot.3.dr	String found in binary or memory: https://fontawesome.comhttps://fontawesome.comFont
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Archivo
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v12/tss0ApVBdCYD5Q7hcxTE1ArZ0bbwiXo.woff)
Source: bootstrap.min[1].css.3.dr, bootstrap.min[1].js.3.dr	String found in binary or memory: https://getbootstrap.com)
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://github.com/eslint/eslint/issues/3229
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://github.com/eslint/eslint/issues/6125
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: bootstrap.min[1].css.3.dr, bootstrap.min[1].js.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.min[1].js.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#category-listed
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace
Source: {9612F055-2BD4-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://jamif-cdn3d.us
Source: ~DF3768AA9CB305EF1C.TMP.2.dr	String found in binary or memory: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://jquery.com/
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://jquery.org/license
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://jsperf.com/getall-vs-sizzle/2
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://jsperf.com/thor-indexof-vs-for/5
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-48
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-54
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-57
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-59
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-61
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-64
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-75
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/Z
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/r
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://sizzlejs.com/
Source: ga[1].js.3.dr	String found in binary or memory: https://ssl.google-analytics.com
Source: Tdcv9KOl0AuohEPI[1].htm0.3.dr	String found in binary or memory: https://ssl.google-analytics.com/ga.js
Source: ga[1].js.3.dr	String found in binary or memory: https://ssl.google-analytics.com/j/__utm.gif
Source: ga[1].js.3.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect?
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://ukrainianpolicy.ru/Dee23ope11nov/next.php
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a
Source: {9612F055-2BD4-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://workflowy-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.htmlRoot
Source: {9612F055-2BD4-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://workflowy.com/
Source: signup[1].htm0.3.dr, login[1].htm0.3.dr	String found in binary or memory: https://workflowy.com/accounts/password_reset/
Source: ~DF3768AA9CB305EF1C.TMP.2.dr	String found in binary or memory: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI
Source: ~DF3768AA9CB305EF1C.TMP.2.dr	String found in binary or memory: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI&Log
Source: imagestore.dat.3.dr	String found in binary or memory: https://workflowy.com/media/i/favicon.ico
Source: imagestore.dat.3.dr	String found in binary or memory: https://workflowy.com/media/i/favicon.ico~
Source: document_view.min[1].js.3.dr	String found in binary or memory: https://workflowy.com/referrals/
Source: {9612F055-2BD4-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://workflowy.com/s/this-doRoot
Source: ~DF3768AA9CB305EF1C.TMP.2.dr, {9612F055-2BD4-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPI
Source: ~DF3768AA9CB305EF1C.TMP.2.dr	String found in binary or memory: https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPI#/7686a5f8c6e6
Source: {9612F055-2BD4-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPIRoot
Source: ~DF3768AA9CB305EF1C.TMP.2.dr	String found in binary or memory: https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPInThis
Source: ~DF3768AA9CB305EF1C.TMP.2.dr	String found in binary or memory: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI
Source: ga[1].js.3.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences?
Source: ga[1].js.3.dr	String found in binary or memory: https://www.google.com/analytics/web/inpage/pub/inpage.js?

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 49187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown	Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49199
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443

Source: classification engine

Classification label: mal64.phis.winXLSX@4/75@12/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Fennec Pharma.xlsx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRD123.tmp

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2552 CREDAT:275457 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2552 CREDAT:275457 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Fennec Pharma.xlsx

Initial sample: OLE zip file path = xl/media/image1.png

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.84.56.113	unknown	United States	14618	AMAZON-AESUS	false
52.217.43.14	unknown	United States	16509	AMAZON-02US	false
74.125.140.154	unknown	United States	15169	GOOGLEUS	false
45.79.137.127	unknown	United States	63949	LINODE-APLinodeLLCUS	false
104.16.19.94	unknown	United States	13335	CLOUDFLARENETUS	false

Contacted Domains

Name	IP	Active
workflowy.com	54.84.56.113	true
us-east-1.linodeobjects.com	45.79.137.127	true
s3.amazonaws.com	52.217.43.14	true
stats.l.doubleclick.net	74.125.140.154	true
cdnjs.cloudflare.com	104.16.19.94	true
ka-f.fontawesome.com	unknown	unknown
code.jquery.com	unknown	unknown
kit.fontawesome.com	unknown	unknown
js-agent.newrelic.com	unknown	unknown
maxcdn.bootstrapcdn.com	unknown	unknown
jamif-cdn3d.us-east-1.linodeobjects.com	unknown	unknown
bam-cell.nr-data.net	unknown	unknown
stats.g.doubleclick.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPI#/7686a5f8c6e6	false		high
https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	true	SlashNext: Fake Login Page type: Phishing & Social Engineering	unknown
https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	false		high
https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPI	false		high
https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	false		high

AV Detection:

Antivirus detection for URL or domain

Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish_10

Source: Yara match	File source: 305090.3.links.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\dfce06801e1a85d6d06f1fdd4475dacd[1].htm, type: DROPPED

Phishing site detected (based on image similarity)

Source: https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/rC56cpX1uS2qJKOxJ-5Sb8u-.svg

Matcher: Found strong image similarity, brand: Microsoft

Jump to dropped file

Phishing site detected (based on logo template match)

Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html

Matcher: Template: microsoft matched

HTML body contains low number of good links

Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: Number of links: 0
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: Title: Log-In does not match URL
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: Title: Log-In does not match URL

Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: No <meta name="author".. found
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: No <meta name="author".. found
Source: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="author".. found
Source: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="author".. found
Source: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="author".. found
Source: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="author".. found

Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: No <meta name="copyright".. found
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html	HTTP Parser: No <meta name="copyright".. found
Source: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="copyright".. found
Source: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="copyright".. found
Source: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="copyright".. found
Source: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI	HTTP Parser: No <meta name="copyright".. found

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 74.125.140.154 74.125.140.154
Source: Joe Sandbox View	IP Address: 104.16.19.94 104.16.19.94

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7187B60E.png

Jump to behavior

Source: document_view.min[1].js.3.dr

Source: unknown

DNS traffic detected: queries for: workflowy.com

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A.3.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F8008506.3.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: document_view.min[1].js.3.dr	String found in binary or memory: http://getfirefox.com
Source: document_view.min[1].js.3.dr	String found in binary or memory: http://google.com/chrome
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: http://jquery.org/license
Source: popper.min[1].js.3.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: ga[1].js.3.dr	String found in binary or memory: http://www.google-analytics.com
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=378607
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=449857
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=470258
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.jquery.com/ticket/12359
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.jquery.com/ticket/13378
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=137337
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#resolved-values
Source: free-fa-regular-400[1].eot.3.dr, free.min[1].css.3.dr	String found in binary or memory: https://fontawesome.com
Source: free.min[1].css.3.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: free-fa-regular-400[1].eot.3.dr, free-fa-solid-900[1].eot.3.dr	String found in binary or memory: https://fontawesome.comhttps://fontawesome.comFont
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Archivo
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v12/tss0ApVBdCYD5Q7hcxTE1ArZ0bbwiXo.woff)
Source: bootstrap.min[1].css.3.dr, bootstrap.min[1].js.3.dr	String found in binary or memory: https://getbootstrap.com)
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://github.com/eslint/eslint/issues/3229
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://github.com/eslint/eslint/issues/6125
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: bootstrap.min[1].css.3.dr, bootstrap.min[1].js.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.min[1].js.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#category-listed
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace
Source: {9612F055-2BD4-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://jamif-cdn3d.us
Source: ~DF3768AA9CB305EF1C.TMP.2.dr	String found in binary or memory: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://jquery.com/
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://jquery.org/license
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://jsperf.com/getall-vs-sizzle/2
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://jsperf.com/thor-indexof-vs-for/5
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-48
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-54
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-57
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-59
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-61
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-64
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://promisesaplus.com/#point-75
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/Z
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/r
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://sizzlejs.com/
Source: ga[1].js.3.dr	String found in binary or memory: https://ssl.google-analytics.com
Source: Tdcv9KOl0AuohEPI[1].htm0.3.dr	String found in binary or memory: https://ssl.google-analytics.com/ga.js
Source: ga[1].js.3.dr	String found in binary or memory: https://ssl.google-analytics.com/j/__utm.gif
Source: ga[1].js.3.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect?
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.3.dr	String found in binary or memory: https://ukrainianpolicy.ru/Dee23ope11nov/next.php
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: jquery-3.3.1[1].js.3.dr	String found in binary or memory: https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a
Source: {9612F055-2BD4-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://workflowy-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.htmlRoot
Source: {9612F055-2BD4-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://workflowy.com/
Source: signup[1].htm0.3.dr, login[1].htm0.3.dr	String found in binary or memory: https://workflowy.com/accounts/password_reset/
Source: ~DF3768AA9CB305EF1C.TMP.2.dr	String found in binary or memory: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI
Source: ~DF3768AA9CB305EF1C.TMP.2.dr	String found in binary or memory: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI&Log
Source: imagestore.dat.3.dr	String found in binary or memory: https://workflowy.com/media/i/favicon.ico
Source: imagestore.dat.3.dr	String found in binary or memory: https://workflowy.com/media/i/favicon.ico~
Source: document_view.min[1].js.3.dr	String found in binary or memory: https://workflowy.com/referrals/
Source: {9612F055-2BD4-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://workflowy.com/s/this-doRoot
Source: ~DF3768AA9CB305EF1C.TMP.2.dr, {9612F055-2BD4-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPI
Source: ~DF3768AA9CB305EF1C.TMP.2.dr	String found in binary or memory: https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPI#/7686a5f8c6e6
Source: {9612F055-2BD4-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPIRoot
Source: ~DF3768AA9CB305EF1C.TMP.2.dr	String found in binary or memory: https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPInThis
Source: ~DF3768AA9CB305EF1C.TMP.2.dr	String found in binary or memory: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI
Source: ga[1].js.3.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences?
Source: ga[1].js.3.dr	String found in binary or memory: https://www.google.com/analytics/web/inpage/pub/inpage.js?

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 49187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown	Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49199
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443

Source: classification engine

Classification label: mal64.phis.winXLSX@4/75@12/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Fennec Pharma.xlsx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRD123.tmp

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2552 CREDAT:275457 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2552 CREDAT:275457 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Fennec Pharma.xlsx

Initial sample: OLE zip file path = xl/media/image1.png

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

ID:	321368
Product:	CloudBasic
Start time:	00:34:40
Start date:	21.11.2020
Sample:	Fennec Pharma.xlsx
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	a2315b66552273d966bdc8570a6a7208
SHA1:	ad82640b54ce17f43e9df68ebfa700de48df5ef0
SHA256:	8c3a18ce48dbab7971870da260421c03483e279795768bfdeb0ee7dd6079ec2b
Filetype:	Excel Microsoft Office Open XML Format document (40004/1) 83.33%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, 58936 bytes, 1 file	DB381E85D86EA4484D20078E9EC667A6	4871FDAF0C2EEC8183FC3CE7710B18FD3C647CEA	C3520E3A6EB43F6D416852C454414C5D7823A96FB9070BC30301ADDEBB334D4D
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	6AEB4E76C6F68EFD7A48092E9F0F3492	823A035C0BDCC3DC09C881E788F7FACA53C6B458	FE1B9A0EABF44FDBE4DDE97C3CC1209FAD2FBB2D2D7476FFBF64066BD9919A4F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	55217B0086C04EFCB86482A57860B6C5	BB073FF88E35F3A545C72C21F110BDF2507DC812	E0122F3D215474123C0B29FC3BBAA3B4B2D4EDD4097BB916FFBA846086385229
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	ACF08B7F8857A98C76B3D939402C4105	E1B693BB48AF4D278E9A7A2740BE70504903A1A2	924B17EEF411C8A5496BE49187F43FC5571A3D3606E0A31220997FFF432D59C0
C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico	PNG image data, 16 x 16, 4-bit colormap, non-interlaced	9FB559A691078558E77D6848202F6541	EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31	6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\MP98E46N\workflowy[1].xml	ASCII text, with very long lines, with no line terminators	25DCC58829A10EDED0F5B66D797ED72D	B7F36CF18F9616295715F02612294D86393BFA58	A671618AA29D31BB4E32CDCCFE21C7A20C5B1FB632C5582029A63A17F9FD657F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9612F053-2BD4-11EB-ADCF-ECF4BBB5915B}.dat	Microsoft Word Document	85FA6855AB623D9B9E1DE6CF913038C9	F020226CFB40E69692B8DB627C390E48B0D67EA5	F8EAB58326A5AE0E9829260A8E1DF56CCB09ED979C544658997B9705C6DD9B36
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9612F055-2BD4-11EB-ADCF-ECF4BBB5915B}.dat	Microsoft Word Document	FF47694B95BF9343481FB88EDFF91302	0BD9C14962DE4EB0C5F8E7962DFE4C2B55F89C55	FAEDFA7C31B9E03CD94FD20ABB6B211D65D7062462F5AEC21D22AF9F7720B992
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{ABFD1AF3-2BD4-11EB-ADCF-ECF4BBB5915B}.dat	Microsoft Word Document	6DCAF46679F1D04E895024B42E1A4981	CCC8B9B884A96B0ABBA89DD33F9D09A2ACAA23E9	78E776BF618D04F584D316B37272E8E307478C0C4E03DEEDEF0567202C0DF09E
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\lr5drzg\imagestore.dat	data	BC5085FD80D31DECAAD1B2E4D6130948	CF66FF5C2DC9917D0885C030FD8244962C753F95	249EFB78AC57847995317893BDF4AE3F2A373037A66702F339CF3C1B68242AAB
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\Tdcv9KOl0AuohEPI[1].htm	HTML document, ASCII text, with very long lines	03269F4126D90C4C428AFE973D022124	0057211680BA85A0AD350BA6186C028A70BC6E43	9CFDC3D608A2EDA61FA51663976F0EADC640D8C60AE1834997AA82C38D9D99FA
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\css[1].css	ASCII text	72C5D331F2135E52DA2A95F7854049A3	572F349BB65758D377CCBAE434350507341ACD7B	C3A12D7E8F6B2B1F5E4CD0C9938DFC79532AEF90802B424EE910093F156586DA
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\eaeea54ab7[1].js	ASCII text, with no line terminators	79F2D634CE67570918939DF10A075576	BA47B7DACB11250F9B1B3974B34954B188E3ECAD	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\eaeea54ab7[2].js	ASCII text, with no line terminators	79F2D634CE67570918939DF10A075576	BA47B7DACB11250F9B1B3974B34954B188E3ECAD	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\favicon[1].ico	PNG image data, 16 x 16, 4-bit colormap, non-interlaced	9FB559A691078558E77D6848202F6541	EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31	6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\login[1].htm	HTML document, ASCII text, with CRLF line terminators	7B4F513528A3D65397F0E7F6DEF7AD4A	5DA8E55D7F30D9530BDEFB6FD670C273FF9DDD66	5075788CBBDF48D111B4882949D3E50856C81CA87630A85D7C8DD1E600CDC691
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\rC56cpX1uS2qJKOxJ-5Sb8u-[1].svg	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\signup[1].htm	HTML document, ASCII text, with CRLF line terminators	7B4F513528A3D65397F0E7F6DEF7AD4A	5DA8E55D7F30D9530BDEFB6FD670C273FF9DDD66	5075788CBBDF48D111B4882949D3E50856C81CA87630A85D7C8DD1E600CDC691
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\Tdcv9KOl0AuohEPI[1].htm	HTML document, ASCII text, with very long lines	5647C1EA961BA66835CED2B1F335B331	6829634742D868F0034A7ED5E0DC5BD8F8F77F14	38FB7C96F662BF69604AB465DB140B27F66B1CA55C9520D2F4158E4A19A02734
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ZJH_2F3Xi0SopxxCuN7EKeDY[1].jpg	JPEG image data, baseline, precision 8, 1920x1080, frames 3	7916A894EBDE7D29C2CC29B267F1299F	78345CA08F9E2C3C2CC9B318950791B349211296	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\dfce06801e1a85d6d06f1fdd4475dacd[1].htm	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	50A0037A600BA8C10F993DB1F075AF0C	6CF8EC58F39CC2D77BC7CE84FED0C669E84D9E21	3660F800D33EA3E7A1835B48188AA5F50ADBE40E1E833246159699673AEBAAAD
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\eaeea54ab7[1].gif	GIF image data, version 89a, 1 x 1	BC32ED98D624ACB4008F986349A20D26	2D3DF8C11D2168CE2C27E0937421D11D85016361	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\free-v4-shims.min[1].css	ASCII text, with very long lines	2E4C3DA4EAE1C876A281D6CA5A7A5B4C	92AD084AAB53B7AA8C761CD66BDFB1F79B9CAED7	CFFF9EA502195A7B96FE38DECA9188A59B758DEEECC2CD4E78AEA7D911E638C6
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\free.min[1].css	ASCII text, with very long lines	319D424BA89A84BBD230A3B5F7024193	1AE1807CDED8F2E41D2541BCCA8E0D7077FBA6F4	4F02BD6F018D6F08C37C39F2D114101BEAC342C2C065046635E5ED0C42853590
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\login[1].htm	HTML document, ASCII text, with very long lines	5462057035E108135972ABB914FB85A8	580BDFA18401421EC757AA11F6138BE4DE233D6B	357F8DC902E87B5F314CBCC917B670FE608B3284BE46ED5AD083A64D9126FF99
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\logo-bullet-lines-blue[1].svg	SVG Scalable Vector Graphics image	7C6542F8D09ED039CEAD9A46BA912E53	45BECA1B83D4B72F79D1A10C6210ACDFF355C23B	1255B7A53BEFBB4A3C4031F9582FE1936B8D124DE5B8B693B03358CB3E492071
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\print[1].css	ASCII text	7471DC37D85CB2B6BAAC70B6A9312DB4	D4775C3D288899890AA0874D3F9AC33843680119	858EBBB77D7504548FED0FB9088D90B774945E88B0464D42A44C4829A84B972D
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\reset[1].css	ASCII text	11B989919D8B8857A3700B00F4E8F184	0D909DA6DE2B0157D07D0FCB721221F5D49688C0	20B1C4B5D2BE0EED0ABB524023534E08D98D34D82C01D60CEB40D9B387EB8AC5
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\urlblockindex[1].bin	data	FA518E3DFAE8CA3A0E495460FD60C791	E4F30E49120657D37267C0162FD4A08934800C69	775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\e42577a28f6c3e306a7f[1].js	ASCII text, with very long lines	AD5D37EB59C3360ECE2973696A3520D4	74E94926731088E2CCD62DD065CDB1B7316FF1AA	1463EEA0C3698C8760F805F7720FC1A8195AF56227DF0D22CCEB1955C2858646
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\eaeea54ab7[1].gif	GIF image data, version 89a, 1 x 1	BC32ED98D624ACB4008F986349A20D26	2D3DF8C11D2168CE2C27E0937421D11D85016361	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\favicon[1].ico	MS Windows icon resource - 6 icons, 256x256, 32 bits/pixel, 128x128, 32 bits/pixel	F411E7E8A5B13EB1DE3974675C0D8CFC	86E1C2A83787FF51333BA6CF512A7C125DE16429	D183C18DB92DD74B44320182C14B12A627B9F0A836776A7E0C263BE8D2792995
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\free-fa-regular-400[1].eot	Embedded OpenType (EOT), Font Awesome 5 Free Regular family	991B587DBEE2E132C9542FB1280F1372	660DA8C03735C9DFFB26205AAD19EA6B1916268A	44F6500D0D5D7F3F8422B9790EAA47DF4E1D812C90239602E53429376B96D1DF
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\free-fa-solid-900[1].eot	Embedded OpenType (EOT), Font Awesome 5 Free Solid family	D3B45D588F61AB38CB31CBA544B4373C	627D2C71A5FFC7E5F17DA0897EE1B73CD30D255F	366C63E48A15576AA55ED76DB0EBCCA8BCE15F6EFC881BD0AC75982FF1233699
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\jquery-3.3.1[1].js	ASCII text	6A07DA9FAE934BAF3F749E876BBFDD96	46A436EBA01C79ACDB225757ED80BF54BAD6416B	D8AA24ECC6CECB1A60515BC093F1C9DA38A0392612D9AB8AE0F7F36E6EEE1FAD
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\nr-1184.min[1].js	ASCII text, with very long lines, with no line terminators	3D7F312BE60D08A2568E311E4762F3AF	EDC028ACC27FB8DC6E2106A071A03AE7F93DC3B4	780861F2AB29C0144055244696561FB0306C8CB3CB7F548F9105C763B0E91F77
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\popper.min[1].js	ASCII text, with very long lines	70D3FDA195602FE8B75E0097EED74DDE	C3B977AA4B8DFB69D651E07015031D385DED964B	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\site.min[1].js	UTF-8 Unicode text, with very long lines, with LF, NEL line terminators	D06B9C7BBDB584E891AF7470C540373F	9E09177E303D5EC1876E1183842BFE60D4BCBC17	1D96DED3CBB2E05D247CA03185BA021F790DBE8AABDD03DF56BBC27AB84BD7D6
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\6f0b670eddaac85c5e4a[1].js	UTF-8 Unicode text, with very long lines	8AFD3E7AEF0EF52C3EC7F4647F443AE4	21B6CC97A07DE5C5E62A5A0BEE624DE2B8033A23	FA8372A7BFB9536773A97EF134BD77AAA88295B10382F5885C70C639C51EB5B3
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\adf9fc155506e2fa3fbf[1].js	ASCII text, with very long lines	B0CCC823DF717416D5EAA426AAC6BA86	6984D4F8B021EC07E4EEB338F9F6F8431C6C18EB	53BDF5DAE2A46EE74470051D7AF9FB93BEAF8659D193322D4916EB758FE87294
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\bootstrap.min[1].css	ASCII text, with very long lines	450FC463B8B1A349DF717056FBB3E078	895125A4522A3B10EE7ADA06EE6503587CBF95C5	2C0F3DCFE93D7E380C290FE4AB838ED8CADFF1596D62697F5444BE460D1F876D
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\bootstrap.min[1].js	ASCII text, with very long lines	14D449EB8876FA55E1EF3C2CC52B0C17	A9545831803B1359CFEED47E3B4D6BAE68E40E99	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\document_view.min[1].js	UTF-8 Unicode text, with very long lines, with NEL line terminators	4178D793497614CBF5B74C0C8979754F	700184FFA5B57AF2316B37DF357E02BA2346352B	AA3D1A96BF8F4EED52C33D311D1CEDE1A735C7595E567BF81E9397480B7E4D48
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\ga[1].js	ASCII text, with very long lines	E9372F0EBBCF71F851E3D321EF2A8E5A	2C7D19D1AF7D97085C977D1B69DCB8B84483D87C	1259EA99BD76596239BFD3102C679EB0A5052578DC526B0452F4D42F8BCDD45F
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\jquery-3.1.1.min[1].js	ASCII text, with very long lines	E071ABDA8FE61194711CFC2AB99FE104	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\jquery-3.2.1.slim.min[1].js	ASCII text, with very long lines	5F48FC77CAC90C4778FA24EC9C57F37D	9E89D1515BC4C371B86F4CB1002FD8E377C1829F	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\jquery.min[1].js	ASCII text, with very long lines	2F6B11A7E914718E0290410E85366FE9	69BB69E25CA7D5EF0935317584E6153F3FD9A88C	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\signup[1].htm	HTML document, ASCII text, with very long lines	8A0730731A4463EAF1E9C6057B1CE100	C654D4BC0F4FE542744603F4478A6EDAE4A4ED3E	38DFDE1431EE46C01C9F41C1DF70DBEE7415BBE0C0C83787F2736330DEB59F48
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7187B60E.png	PNG image data, 1420 x 1525, 8-bit/color RGB, non-interlaced	4DD10B6F17BC84B07109F3DDE525362E	D0FB1D7E063D58D71DBFDEE083AE6F181D96DB3E	D98B1F1E9A3B3703D9B1AF00D0D6DA248E13861F821AC347DC01AF67699B8E6B
C:\Users\user\AppData\Local\Temp\Cab66CD.tmp	Microsoft Cabinet archive data, 58936 bytes, 1 file	E4F1E21910443409E81E5B55DC8DE774	EC0885660BD216D0CDD5E6762B2F595376995BD0	CF99E08369397577BE949FBF1E4BF06943BC8027996AE65CEB39E38DD3BD30F5
C:\Users\user\AppData\Local\Temp\Cab671D.tmp	Microsoft Cabinet archive data, 58936 bytes, 1 file	E4F1E21910443409E81E5B55DC8DE774	EC0885660BD216D0CDD5E6762B2F595376995BD0	CF99E08369397577BE949FBF1E4BF06943BC8027996AE65CEB39E38DD3BD30F5
C:\Users\user\AppData\Local\Temp\Tar66CE.tmp	data	D0682A3C344DFC62FB18D5A539F81F61	09D3E9B899785DA377DF2518C6175D70CCF9DA33	4788F7F15DE8063BB3B2547AF1BD9CDBD0596359550E53EC98E532B2ADB5EC5A
C:\Users\user\AppData\Local\Temp\Tar671E.tmp	data	D0682A3C344DFC62FB18D5A539F81F61	09D3E9B899785DA377DF2518C6175D70CCF9DA33	4788F7F15DE8063BB3B2547AF1BD9CDBD0596359550E53EC98E532B2ADB5EC5A
C:\Users\user\AppData\Local\Temp\~DF091722ACA51A2E65.TMP	data	9D5F741399BE727DA88584F633E2164A	01FB3CBC5D84AB6C63130597C53A0738CBD1A473	006FEDE0BF0E1D7C6C8007F364BDDE915567AED191A6C58F5303D2234C0CB659
C:\Users\user\AppData\Local\Temp\~DF3768AA9CB305EF1C.TMP	data	8C73D6C9FF1EB001AAE6FC5A6661DD42	ECD3CF431653F93691A23EF85C4D287A38CF6139	1CF31115D1827B3E0116DB7BB545395850E50C57280B139BA56BA3C632ADB383
C:\Users\user\AppData\Local\Temp\~DFB1D5C56FF7851F42.TMP	data	160088BF8418AF706022501FA273FA15	5101825FCBA9B270013D0471418371D68609772D	ED19D9439DDFFC00374D6BBE89928F0C65802178F8D3A3E1B233366864EA4CA2
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\1WK6T6E9.txt	ASCII text	EFF963BDA7ACABDB1F54767C03AC0C82	E435479266CBD5B00F1181C10B573EDD449E34C7	BD28B3753685E9D9B5291F569649E1B837F40E557F1D647A08F1F6B03DB1C5E4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\3UUPYR02.txt	ASCII text	046A53D8418B40D4226836CDEC656DA5	65E856468D6ADE25E1DB0F65CFBFD15E8B2DB6D4	4F30E1A703A6B749A30C01666B875222EF50B49A96A75AE11D540B14615612F3
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\B8LOWNP4.txt	ASCII text	5FECC73F5B864DE779F94D9C68E96671	D57EDFEA0BAB8ECAA2D5094B49E6026999F12019	0A643C88E1BB9B39140DB2260978627B67B7779646645F9C5DBC20258D0D1936
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\C08G4TO5.txt	ASCII text	F6DA581A4C791EED896ADAB3D867B46B	7B270C6D88E17CFEDC9ED1E1308C4C8D39B50616	B128BBB9FA65F3DF7EA810729304677C2AC59B528CC80BA29EE8AA4E0F04A61B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\EJ38YTYP.txt	ASCII text	CC4539C877B1D31FB091F65E3D4DE320	A3AE0E80A604020A4B812A1D4E039FB57EF7149C	B914CB633C2BAB83679071AF8930B278C28E576425D1A5C76C2F614DD57E3BBB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\FJQJA7G9.txt	ASCII text	1862C7D447217F26A7D0C486CF748E73	7C36F84FB890FC342992ADBC54C5AF58BD7CFDB3	878EAD3DCD7A7B80342E00541E70BDAB480A496CECBCE593181AEE98F6D7E950
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\GNHVW6BT.txt	ASCII text	1AB2CDE892CDDB190D6215823C1196D7	5D197DDBD88600EB801F437027ABB307CE48C55E	E3B1F227AF47E0EDA204DB4335FCE9EBE21349CC5AF2F46E656E37D777785949
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\HWA2M6MO.txt	ASCII text	BBB4E96E9424A98A546F5AAACBD212DA	093C4035B637E807FAC417E821EB4A4F80846DB1	C10DB9034926FB14B1D1623CEE53FC7DB64EBC9AFB9A21276186EB1E0DC5DC02
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\KIVMU0HH.txt	ASCII text	1CDE935F76C5B3CDA7C683F2558A777D	1B48DD7306B3C5FF128BC585E0AB868E2E69BB8F	00CEC227A7BB0F9058D6DC5B392932D1AF7BF2BA429351DB0F15A0A99A9B2D4E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\KVH6AM6A.txt	ASCII text	26F582D9E67F16FFBC3209EDF1F8A13B	612FEE83F0CB0FB095BED46249CF797CED16C38D	3BCE52AB018947D02651576782F23943163A2B82F6363AB6FA809032E65F2C3F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\OKD2JEM2.txt	ASCII text	ABFCB2A73B0B7114ABCB97EEBEA8F155	3007E10CDCE20DCD8C279FD5F694DC9AB75105D6	2122C744F483DF224F37BAC31087A32D82BD17D23F79E54A9D8CF574217DB8AF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\P0VR5QOE.txt	ASCII text	67AAECE1C30AA3AABC2B2E4509FAA1C2	8F13C1DD475F7EB113D0A23ABBFFCAD2E6471AE7	253707FD76167C8748CEBBB5D272BC5F91CA80EAEDD10648A25C246A0CB05D93
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Q0N28S8O.txt	ASCII text	CEA5DEF22C75F28AB9A6DC7D1C7DB303	7A78E25F588EAC06642B00A9C0F666BB0C98C7CC	58B0D59001BDD4D363C9C3E77209475B61686E9A743FA4F093B1094B7538D60F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\RP8HJGZS.txt	ASCII text	B32CFAE218C2453FB0382197DCCF27BE	61AEE5CD1438CD165992BA5BDF0AE7AB29924956	ECA856B24CF272A864C409B0369F2D02E2ABAA1183B42045B8D16DC7FC3C83BF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\THU81BG5.txt	ASCII text	7F5CCBA33EF26CE0F3B4789C4E006E2C	64499129269B3A9220A1EDA4092697159E95A857	92F362D19CC4899909CD59DC59CE644AB80894ACE0E183F44717ABED4818A733
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\VTFEJJP0.txt	ASCII text	D8187D1AA0870EC8B0877D78EF09728F	EE60CC03858E85AE41292F886D3DC2FCF3C57259	6C20F9321728CE33515D40D8999A50F89004E8A2189685B63C172E81F3ED0A69
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\XA5F7322.txt	ASCII text	323CD1F8736757074CFE63153BA0840C	59ADEE9EE4E7A50580C3CAB1A913509A996812B1	25F3F8895256CB00F9C0420ACC329C135B885ACD89C5601327D88F8AE5259B62
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\XLJJ3868.txt	ASCII text	F1439DCFA22F568F99CB2C7A59C573DE	F83A88A38AF2C170EA52B1BDCCFC73B165C9073D	88435557D05E2F06A6793322994611AC1E94330F17E4EDA329712C04FC99CE69
C:\Users\user\Desktop\~$Fennec Pharma.xlsx	data	797869BB881CFBCDAC2064F92B26E46F	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185

Analysis Report Fennec Pharma.xlsx

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Phishing:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs