Play interactive tour
Edit tourAnalysis Report document-1442300824.xls
Overview
General Information
| Sample Name: | document-1442300824.xls |
| Analysis ID: | 324306 |
| MD5: | c6c9c84c957dcbdb12168cfcd680f2e7 |
| SHA1: | 5fed70088c09ac3a40ba71203f18c47a3ec0ca6a |
| SHA256: | 7ea07a02f138a4eed3569273412432dbb40f8da4f7c9384de14e878772302047 |
| Tags: | goziSilentBuilderursnifxls |
Most interesting Screenshot:  | |
Detection
Hidden Macro 4.0
| Score: | 80 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found obfuscated Excel 4.0 Macro
Sigma detected: Microsoft Office Product Spawning Windows Shell
Yara detected hidden Macro 4.0 in Excel
Allocates a big amount of memory (probably used for heap spraying)
Document contains embedded VBA macros
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Tries to load missing DLLs
Yara signature match
Classification
Startup |
|---|
|
Malware Configuration |
|---|
| No configs have been found |
|---|
Yara Overview |
|---|
Initial Sample |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| SUSP_Excel4Macro_AutoOpen | Detects Excel4 macro use with auto open / close | John Lambert @JohnLaTwC |
| |
| JoeSecurity_HiddenMacro | Yara detected hidden Macro 4.0 in Excel | Joe Security |
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Microsoft Office Product Spawning Windows Shell | Show sources | ||
| Source: | Author: Michael Haag, Florian Roth, Markus Neis: | ||
Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: | |
|---|
| Multi AV Scanner detection for submitted file | Show sources | ||
| Source: | Virustotal: | Perma Link | ||
Software Vulnerabilities: | |
|---|
| Document exploit detected (UrlDownloadToFile) | Show sources | ||
| Source: | Section loaded: | Jump to behavior | ||
| Document exploit detected (process start blacklist hit) | Show sources | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Memory has grown: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
System Summary: | |
|---|
| Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) | Show sources | ||
| Source: | Screenshot OCR: | ||
| Found Excel 4.0 Macro with suspicious formulas | Show sources | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Found obfuscated Excel 4.0 Macro | Show sources | ||
| Source: | Initial sample: | ||
| Source: | OLE indicator, VBA macros: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Matched rule: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
HIPS / PFW / Operating System Protection Evasion: | |
|---|
| Yara detected hidden Macro 4.0 in Excel | Show sources | ||
| Source: | File source: | ||
Mitre Att&ck Matrix |
|---|
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Scripting21 | DLL Side-Loading1 | Process Injection1 | Masquerading1 | OS Credential Dumping | Security Software Discovery1 | Remote Services | Data from Local System | Exfiltration Over Other Network Medium | Encrypted Channel2 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Exploitation for Client Execution23 | Boot or Logon Initialization Scripts | DLL Side-Loading1 | Disable or Modify Tools1 | LSASS Memory | File and Directory Discovery1 | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Non-Application Layer Protocol1 | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | Extra Window Memory Injection1 | Process Injection1 | Security Account Manager | System Information Discovery2 | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Application Layer Protocol2 | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Scripting21 | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Scheduled Transfer | Protocol Impersonation | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | Regsvr321 | LSA Secrets | Remote System Discovery | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | DLL Side-Loading1 | Cached Domain Credentials | System Owner/User Discovery | VNC | GUI Input Capture | Exfiltration Over C2 Channel | Multiband Communication | Jamming or Denial of Service | Abuse Accessibility Features | |
| External Remote Services | Scheduled Task | Startup Items | Startup Items | Extra Window Memory Injection1 | DCSync | Network Sniffing | Windows Remote Management | Web Portal Capture | Exfiltration Over Alternative Protocol | Commonly Used Port | Rogue Wi-Fi Access Points | Data Encrypted for Impact |
Behavior Graph |
|---|
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetScreenshots |
|---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
|---|
Initial Sample |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 37% | Virustotal | Browse | ||
| 14% | Metadefender | Browse | ||
| 6% | ReversingLabs | Document-Word.Trojan.Heuristic |
Dropped Files |
|---|
| No Antivirus matches |
|---|
Unpacked PE Files |
|---|
| No Antivirus matches |
|---|
Domains |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 1% | Virustotal | Browse |
URLs |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
Domains and IPs |
|---|
Contacted Domains |
|---|
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| seligue.net | 192.185.215.146 | true | false |
| unknown |
URLs from Memory and Binaries |
|---|
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
Contacted IPs |
|---|
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
Public |
|---|
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 192.185.215.146 | unknown | United States | 46606 | UNIFIEDLAYER-AS-1US | false |
General Information |
|---|
| Joe Sandbox Version: | 31.0.0 Red Diamond |
| Analysis ID: | 324306 |
| Start date: | 29.11.2020 |
| Start time: | 04:59:42 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 4m 22s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Sample file name: | document-1442300824.xls |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Run name: | Potential for more IOCs and behavior |
| Number of analysed new started processes analysed: | 27 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal80.expl.evad.winXLS@3/6@1/1 |
| EGA Information: | Failed |
| HDC Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
| Warnings: | Show All
|
Simulations |
|---|
Behavior and APIs |
|---|
| No simulations |
|---|
Joe Sandbox View / Context |
|---|
IPs |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 192.185.215.146 | Get hash | malicious | Browse | ||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse |
Domains |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| seligue.net | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
ASN |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| UNIFIEDLAYER-AS-1US | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
JA3 Fingerprints |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
Dropped Files |
|---|
| No context |
|---|
Created / dropped Files |
|---|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 129952 |
| Entropy (8bit): | 5.3783271546378915 |
| Encrypted: | false |
| SSDEEP: | 1536:1cQceNWiA3gZwLpQ9DQW+zAUH34ZldpKWXboOilXPErLL8TT:nmQ9DQW+zBX8u |
| MD5: | C923C4CCE921822AE1E4C5A9537C09CA |
| SHA1: | E629669A9813353B52635D9F88E8ED938CCBCBD7 |
| SHA-256: | E81DA3F2F4D174CFC922B062A71024180EC8875A822BAF91EA9EF6B9889BB2AB |
| SHA-512: | F38574A7A118F7D4027061E079FAA1EB16509C50B33C3278C7D34DCA9216D5679D38D00DA4AA409CE3EBC245A117A486B474C6ADCF32DEB373BBE190B7090D66 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 314642 |
| Entropy (8bit): | 7.985551589950971 |
| Encrypted: | false |
| SSDEEP: | 6144:mBlrFLPodmRqyAVYtlKsVLCyo7NtbcY7uLaG/9t7+ME:oFPM8R3AsB+bjej/9cr |
| MD5: | 8A87BBE971419419593AD00D0D2AC5ED |
| SHA1: | 0904D0EF21A86F46376E11F2CA7EE5AAEE1FFBCE |
| SHA-256: | 5E19CC21660276E53731C062B32E212BF86862196B5EC596356CEFD5653864D2 |
| SHA-512: | 616E64C33A94DFC3396DAA9220A73FCA459C06CDB4EA7EEE51022D80BB2A1F71A8732FFA118A80CC3CA72B0C8C5EE18693DAE359BB417E6284CA5BFAE7F6726F |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 904 |
| Entropy (8bit): | 4.6289446827332394 |
| Encrypted: | false |
| SSDEEP: | 12:8nvcXUllhuElPCH21Yh0712+I7+WrjAZ/2bD5LC5Lu4t2Y+xIBjKZm:8vzQd9AZiDQ87aB6m |
| MD5: | A9AD50D5FA0C6C4F3B6668540B38EC92 |
| SHA1: | 5515CA486C691EB7D0B1AB01351FE6B2CF0D73C4 |
| SHA-256: | A3FC003FE90B5D2F6DB19873A72E842E7E370DAF1587798B467F9FA3B786E6AE |
| SHA-512: | BA0DDA1049D3A778E7ABB9465F2B41C3AE4BC99EF3E24CBACCDD38528A57BD1FF74E27195C49174202BC797F182E50297AECA3D3E2260D319FCCF133232380EF |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4400 |
| Entropy (8bit): | 4.693548886726011 |
| Encrypted: | false |
| SSDEEP: | 48:8r0zjRqhOB6pr0zjRqhOB6p60zjRqhOB6p60zjRqhOB6:8yOOKyOOKhOOKhOO |
| MD5: | 88AB182B8FD2E87F7726B13F3B6E1146 |
| SHA1: | 966BA749CD2D322A075E268A51B2A8A72454C54F |
| SHA-256: | 5D0B74CDC79959240D741CE3C8AC88918C719F74276503E26B9D6EEB62864C10 |
| SHA-512: | 43023F6D5084E857501A0D51EA5303EA229AB433287195C5649DD77AEFEEFB62DA03093EFAE68C5B0B1E435E4765F5E2CF193CBC1FBC7A2002E05561B9AE5892 |
| Malicious: | true |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 260 |
| Entropy (8bit): | 4.682821678194146 |
| Encrypted: | false |
| SSDEEP: | 6:dj6Y9Lz5mELz5mY9Lz5mELz5mY9Lz5mELz5mY9Lz52:dmE5n5mE5n5mE5n5mE52 |
| MD5: | DD0930119D789CA36E9B3EAF3088B773 |
| SHA1: | 871F7AD9EB97AE99ACE93A1DADE271C1D634055B |
| SHA-256: | BA11B4D0CC5D78AA929ED01BA89E14AD86F063650E39D524A6300BA8CA2D4E60 |
| SHA-512: | 8006C58561CD41317EA2020042C76EA988B23AE361B7961FAFDCEFD610C441098091B0F75775EBDCCE61CEC316AF7D336EEB53E9805330A2FFB1954F3AF3E936 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 398843 |
| Entropy (8bit): | 7.1924740989465565 |
| Encrypted: | false |
| SSDEEP: | 6144:2cKoSsxzNDZLDZjlbR868O8KiA4XkXOn2xEtjPOtioVjDGUU1qfDlavx+W+LIfdE:1izo8RnsIROnr6n75Y5w/W |
| MD5: | C143E26DE34B1F438CD8612498A39C2D |
| SHA1: | 83DA46D3B856BB0A4A4F7FFB179B7CC4DBAD360B |
| SHA-256: | A9AE24AF7BF6AE08B419B5A767D50BCA4D82091067BC1A6AA47F4D5D52F81A02 |
| SHA-512: | 77C7433CE7DA352EB77BAE38E31A15305AF9C98943D0F0E428ADC225FB5E84B597930D96704065A6817F3B7048B3A058D63BD23855EC183E1E29B561C50D4C03 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
Static File Info |
|---|
General | |
|---|---|
| File type: | |
| Entropy (8bit): | 7.523545982744638 |
| TrID: |
|
| File name: | document-1442300824.xls |
| File size: | 338944 |
| MD5: | c6c9c84c957dcbdb12168cfcd680f2e7 |
| SHA1: | 5fed70088c09ac3a40ba71203f18c47a3ec0ca6a |
| SHA256: | 7ea07a02f138a4eed3569273412432dbb40f8da4f7c9384de14e878772302047 |
| SHA512: | d29ac506d4e3fe75fd1f366e54515dcd4c2ef769d6318ffc3c6bdde4b4ccbf4464f804291f985823cc7ae1afa599ad26b87c92f7898c35ce0c9a44cea7ed23ce |
| SSDEEP: | 6144:IcKoSsxzNDZLDZjlbR868O8Kfc03pXOFq7uDphYHceXVhca+fMHLty/x2zZ8kpTB:8izo8RnsIROnr6n75YYv |
| File Content Preview: | ........................>...................................................................................................................................................................................................................................... |
File Icon |
|---|
 | |
| Icon Hash: | 74ecd4c6c3c6c4d8 |
Static OLE Info |
|---|
General | ||
|---|---|---|
| Document Type: | OLE | |
| Number of OLE Files: | 1 | |
OLE File "document-1442300824.xls" |
|---|
Indicators | |
|---|---|
| Has Summary Info: | True |
| Application Name: | Microsoft Excel |
| Encrypted Document: | False |
| Contains Word Document Stream: | False |
| Contains Workbook/Book Stream: | True |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | |
| Flash Objects Count: | |
| Contains VBA Macros: | True |
Summary | |
|---|---|
| Code Page: | 1251 |
| Author: | |
| Last Saved By: | |
| Create Time: | 2006-09-16 00:00:00 |
| Last Saved Time: | 2020-11-26 09:46:17 |
| Creating Application: | |
| Security: | 0 |
Document Summary | |
|---|---|
| Document Code Page: | 1251 |
| Thumbnail Scaling Desired: | False |
| Contains Dirty Links: | False |
| Shared Document: | False |
| Changed Hyperlinks: | False |
| Application Version: | 917504 |
Streams |
|---|
Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096 |
|---|
General | |
|---|---|
| Stream Path: | \x5DocumentSummaryInformation |
| File Type: | data |
| Stream Size: | 4096 |
| Entropy: | 0.367004077607 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D o c u S i g n . . . . . . . . . 2 . . . . . . . . . 3 . . . . . . . . . 1 . . . . . . . . . 4 . . . . . . . . . 5 . . . . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 00 01 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 bf 00 00 00 02 00 00 00 e3 04 00 00 |
Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096 |
|---|
General | |
|---|---|
| Stream Path: | \x5SummaryInformation |
| File Type: | data |
| Stream Size: | 4096 |
| Entropy: | 0.257530318219 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . | . # . . . @ . . . . . v . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 04 00 00 00 |
Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 326321 |
|---|
General | |
|---|---|
| Stream Path: | Workbook |
| File Type: | Applesoft BASIC program data, first line number 16 |
| Stream Size: | 326321 |
| Entropy: | 7.65589671346 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . f 2 . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . l . . 9 P . 8 . . . . . . . X . @ . . . . . . |
| Data Raw: | 09 08 10 00 00 06 05 00 66 32 cd 07 c9 80 01 00 06 06 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 02 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |
Macro 4.0 Code |
|---|
CALL("Ke"&????2!HV329&"32", "Cr"&????2!HX357&"yA", "JCJ", ????2!HM327&????2!HM342, 0)
CALL("U"&????2!HX347, "U"&????4!E65, "IICCII", 0, ????2!EE100, ????2!HM327&????2!HM342&????2!HM356, 0, 0)
=RUN(R59),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=RUN(????4!D50),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CALL(""Ke""&????2!HV329&""32"",""Cr""&????2!HX357&""yA"",""JCJ"",????2!HM327&????2!HM342,0)",,,,,,,,,,,,,,,,,=RUN(????5!A50),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CALL(""Ke""&????2!HV329&""32"",""Cr""&????2!HX357&""yA"",""JCJ"",????2!HM327,0)",,,,=RUN(????1!M66),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CONCATENATE(E67,E68,E69,E70,E71,E72,E73,E74,E75,E76,E77,E78,E79,E80,E81,E82,E83)",,,,"=CHAR(SUM(F66,G66,H66))",25,35,25,"=CHAR(SUM(F67,G67,H67))",20,42,20,"=CHAR(SUM(F68,G68,H68))",25,26,25,=CHAR(F69-G69-H69),100,22,10,=CHAR(F70-G70-H70),200,50,39,=CHAR(F71-G71-H71),500,300,81,=CHAR(F72+G72-H72),120,130,140,=CHAR(F73+G73-H73),200,300,392,=CHAR(F74+G74-H74),400,500,789,=CHAR(F75-G75+H75),500,430,27,=CHAR(F76-G76+H76),310,270,60,=CHAR(F77-G77+H77),200,160,44,"=CHAR(SUM(F78,G78,H78))",56,37,18,"=CHAR(SUM(F79,G79,H79))",27,18,25,"=CHAR(SUM(F80,G80,H80))",44,58,3,=CHAR(F81-G81-H81),384,115,161,=CHAR(F82-G82-H82),762,504,157,=CHAR(F83-G83-H83),501,328,108"=CALL(""U""&????2!HX347,""U""&????4!E65,""IICCII"",0,????2!EE100,????2!HM327&????2!HM342&????2!HM356,0,0)"=EXEC(????3!W36&????2!HM327&????2!HM342&????2!HM356)=HALT()
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeNetwork Behavior |
|---|
Network Port Distribution |
|---|
TCP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 29, 2020 05:00:40.537276983 CET | 49713 | 443 | 192.168.2.3 | 192.185.215.146 |
| Nov 29, 2020 05:00:40.671185017 CET | 443 | 49713 | 192.185.215.146 | 192.168.2.3 |
| Nov 29, 2020 05:00:40.671365976 CET | 49713 | 443 | 192.168.2.3 | 192.185.215.146 |
| Nov 29, 2020 05:00:40.672934055 CET | 49713 | 443 | 192.168.2.3 | 192.185.215.146 |
| Nov 29, 2020 05:00:40.806742907 CET | 443 | 49713 | 192.185.215.146 | 192.168.2.3 |
| Nov 29, 2020 05:00:40.810530901 CET | 443 | 49713 | 192.185.215.146 | 192.168.2.3 |
| Nov 29, 2020 05:00:40.810600042 CET | 443 | 49713 | 192.185.215.146 | 192.168.2.3 |
| Nov 29, 2020 05:00:40.810622931 CET | 443 | 49713 | 192.185.215.146 | 192.168.2.3 |
| Nov 29, 2020 05:00:40.810957909 CET | 49713 | 443 | 192.168.2.3 | 192.185.215.146 |
| Nov 29, 2020 05:00:40.832307100 CET | 49713 | 443 | 192.168.2.3 | 192.185.215.146 |
| Nov 29, 2020 05:00:40.967051983 CET | 443 | 49713 | 192.185.215.146 | 192.168.2.3 |
| Nov 29, 2020 05:00:40.967433929 CET | 49713 | 443 | 192.168.2.3 | 192.185.215.146 |
| Nov 29, 2020 05:00:40.968322992 CET | 49713 | 443 | 192.168.2.3 | 192.185.215.146 |
| Nov 29, 2020 05:00:41.142458916 CET | 443 | 49713 | 192.185.215.146 | 192.168.2.3 |
| Nov 29, 2020 05:00:41.821365118 CET | 443 | 49713 | 192.185.215.146 | 192.168.2.3 |
| Nov 29, 2020 05:00:41.821588039 CET | 443 | 49713 | 192.185.215.146 | 192.168.2.3 |
| Nov 29, 2020 05:00:41.821681976 CET | 49713 | 443 | 192.168.2.3 | 192.185.215.146 |
| Nov 29, 2020 05:00:41.822345972 CET | 49713 | 443 | 192.168.2.3 | 192.185.215.146 |
| Nov 29, 2020 05:00:41.824274063 CET | 49713 | 443 | 192.168.2.3 | 192.185.215.146 |
| Nov 29, 2020 05:00:41.958106041 CET | 443 | 49713 | 192.185.215.146 | 192.168.2.3 |
UDP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 29, 2020 05:00:23.889094114 CET | 64185 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:00:23.974853039 CET | 53 | 64185 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:00:25.009043932 CET | 65110 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:00:25.044241905 CET | 53 | 65110 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:00:26.166512012 CET | 58361 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:00:26.202085972 CET | 53 | 58361 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:00:27.201622009 CET | 63492 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:00:27.228821039 CET | 53 | 63492 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:00:36.146672964 CET | 60831 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:00:36.196959019 CET | 53 | 60831 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:00:36.529442072 CET | 60100 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:00:36.572810888 CET | 53 | 60100 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:00:37.555334091 CET | 60100 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:00:37.592417002 CET | 53 | 60100 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:00:38.561212063 CET | 60100 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:00:38.599031925 CET | 53 | 60100 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:00:40.370841980 CET | 53195 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:00:40.531529903 CET | 53 | 53195 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:00:40.561213970 CET | 60100 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:00:40.596744061 CET | 53 | 60100 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:00:44.578629017 CET | 60100 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:00:44.614221096 CET | 53 | 60100 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:00:51.248321056 CET | 50141 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:00:51.275451899 CET | 53 | 50141 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:00:59.451857090 CET | 53023 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:00:59.492290020 CET | 53 | 53023 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:01.560600996 CET | 49563 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:01.598613024 CET | 53 | 49563 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:02.683643103 CET | 51352 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:02.719423056 CET | 53 | 51352 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:03.509830952 CET | 59349 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:03.537122965 CET | 53 | 59349 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:04.364999056 CET | 57084 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:04.400325060 CET | 53 | 57084 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:05.160475969 CET | 58823 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:05.187911034 CET | 53 | 58823 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:05.966090918 CET | 57568 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:05.993190050 CET | 53 | 57568 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:06.345943928 CET | 50540 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:06.389478922 CET | 53 | 50540 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:06.769973993 CET | 54366 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:06.805583000 CET | 53 | 54366 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:07.586899042 CET | 53034 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:07.622292042 CET | 53 | 53034 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:08.403347969 CET | 57762 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:08.440912962 CET | 53 | 57762 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:09.280527115 CET | 55435 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:09.320445061 CET | 53 | 55435 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:10.180289984 CET | 50713 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:10.215737104 CET | 53 | 50713 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:13.920293093 CET | 56132 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:13.957663059 CET | 53 | 56132 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:15.730464935 CET | 58987 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:15.807091951 CET | 53 | 58987 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:16.227258921 CET | 56579 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:16.262798071 CET | 53 | 56579 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:16.680978060 CET | 60633 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:16.755916119 CET | 53 | 60633 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:17.100892067 CET | 61292 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:17.136048079 CET | 53 | 61292 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:17.443002939 CET | 63619 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:17.478394985 CET | 53 | 63619 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:17.950234890 CET | 64938 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:17.985884905 CET | 53 | 64938 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:18.870534897 CET | 61946 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:18.906160116 CET | 53 | 61946 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:19.863034964 CET | 64910 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:19.890465021 CET | 53 | 64910 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:20.888047934 CET | 52123 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:20.923934937 CET | 53 | 52123 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:21.438488007 CET | 56130 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:21.474185944 CET | 53 | 56130 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:25.631531954 CET | 56338 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:25.658786058 CET | 53 | 56338 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:26.848087072 CET | 59420 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:26.892339945 CET | 53 | 59420 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:01:28.750158072 CET | 58784 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:01:28.787039042 CET | 53 | 58784 | 8.8.8.8 | 192.168.2.3 |
DNS Queries |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class |
|---|---|---|---|---|---|---|---|
| Nov 29, 2020 05:00:40.370841980 CET | 192.168.2.3 | 8.8.8.8 | 0xb093 | Standard query (0) | A (IP address) | IN (0x0001) |
DNS Answers |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class |
|---|---|---|---|---|---|---|---|---|---|
| Nov 29, 2020 05:00:40.531529903 CET | 8.8.8.8 | 192.168.2.3 | 0xb093 | No error (0) | 192.185.215.146 | A (IP address) | IN (0x0001) |
HTTPS Packets |
|---|
| Timestamp | Source IP | Source Port | Dest IP | Dest Port | Subject | Issuer | Not Before | Not After | JA3 SSL Client Fingerprint | JA3 SSL Client Digest |
|---|---|---|---|---|---|---|---|---|---|---|
| Nov 29, 2020 05:00:40.810622931 CET | 192.185.215.146 | 443 | 192.168.2.3 | 49713 | CN=webdisk.seligue.net CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US | CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co. | Fri Nov 20 17:49:32 CET 2020 Thu Mar 17 17:40:46 CET 2016 | Thu Feb 18 17:49:32 CET 2021 Wed Mar 17 17:40:46 CET 2021 | 771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0 | 37f463bf4616ecd445d4a1937da06e19 |
| CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US | CN=DST Root CA X3, O=Digital Signature Trust Co. | Thu Mar 17 17:40:46 CET 2016 | Wed Mar 17 17:40:46 CET 2021 |
Code Manipulations |
|---|
Statistics |
|---|
CPU Usage |
|---|
Click to jump to process
Memory Usage |
|---|
Click to jump to process
High Level Behavior Distribution |
|---|
back
Click to dive into process behavior distribution
Behavior |
|---|
Click to jump to process
System Behavior |
|---|
General |
|---|
| Start time: | 05:00:34 |
| Start date: | 29/11/2020 |
| Path: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xd00000 |
| File size: | 27110184 bytes |
| MD5 hash: | 5D6638F2C8F8571C593999C58866007E |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 05:00:41 |
| Start date: | 29/11/2020 |
| Path: | C:\Windows\SysWOW64\regsvr32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x13d0000 |
| File size: | 20992 bytes |
| MD5 hash: | 426E7499F6A7346F0410DEAD0805586B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
Disassembly |
|---|
Code Analysis |
|---|