Play interactive tour
Edit tourAnalysis Report 12345.xlsm
Overview
General Information
| Sample Name: | 12345.xlsm |
| Analysis ID: | 382553 |
| MD5: | 5851c6423d6cffdbfdd9ce4276592acb |
| SHA1: | 8992a00647a35e67a887127b5aa7269cc9c597c6 |
| SHA256: | a7893081be92e7c0c1672482df252f282abca98ff09ff559f246bcc5244d74c3 |
| Tags: | GGGoziISFBUrsnifxlsm |
| Infos: | |
Most interesting Screenshot:  | |
Detection
Hidden Macro 4.0
| Score: | 80 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Excel documents contains an embedded macro which executes code when the document is opened
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Yara detected Xls With Macro 4.0
Classification
Startup |
|---|
|
Malware Configuration |
|---|
| No configs have been found |
|---|
Yara Overview |
|---|
Initial Sample |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XlsWithMacro4 | Yara detected Xls With Macro 4.0 | Joe Security |
Sigma Overview |
|---|
| No Sigma rule has matched |
|---|
Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: |   |
|---|
| Multi AV Scanner detection for domain / URL | Show sources | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | Virustotal: | Perma Link | ||
| Multi AV Scanner detection for submitted file | Show sources | ||
| Source: | ReversingLabs: | ||
| Source: | File opened: | Jump to behavior | ||
Software Vulnerabilities: | |
|---|
| Document exploit detected (UrlDownloadToFile) | Show sources | ||
| Source: | Section loaded: | Jump to behavior | ||
| Document exploit detected (process start blacklist hit) | Show sources | ||
| Source: | Process created: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
System Summary: | |
|---|
| Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) | Show sources | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Found Excel 4.0 Macro with suspicious formulas | Show sources | ||
| Source: | Initial sample: | ||
| Found abnormal large hidden Excel 4.0 Macro sheet | Show sources | ||
| Source: | Initial sample: | ||
| Source: | Binary string: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | File source: | ||
Mitre Att&ck Matrix |
|---|
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Scripting21 | DLL Side-Loading1 | Process Injection1 | Regsvr321 | OS Credential Dumping | Security Software Discovery1 | Remote Services | Data from Local System | Exfiltration Over Other Network Medium | Non-Application Layer Protocol3 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Exploitation for Client Execution23 | Boot or Logon Initialization Scripts | DLL Side-Loading1 | Masquerading1 | LSASS Memory | File and Directory Discovery1 | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Application Layer Protocol13 | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | Logon Script (Windows) | Disable or Modify Tools1 | Security Account Manager | System Information Discovery2 | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Ingress Tool Transfer3 | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Process Injection1 | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Scheduled Transfer | Protocol Impersonation | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | Scripting21 | LSA Secrets | Remote System Discovery | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | DLL Side-Loading1 | Cached Domain Credentials | System Owner/User Discovery | VNC | GUI Input Capture | Exfiltration Over C2 Channel | Multiband Communication | Jamming or Denial of Service | Abuse Accessibility Features |
Behavior Graph |
|---|
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetScreenshots |
|---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
|---|
Initial Sample |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 17% | ReversingLabs | Document-Excel.Trojan.Heuristic |
Dropped Files |
|---|
| No Antivirus matches |
|---|
Unpacked PE Files |
|---|
| No Antivirus matches |
|---|
Domains |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 7% | Virustotal | Browse | ||
| 7% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 7% | Virustotal | Browse |
URLs |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe |
Domains and IPs |
|---|
Contacted Domains |
|---|
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| laura9630fr.com | 8.211.4.209 | true | true |
| unknown |
| mills-skyla30ec.com | 8.211.4.209 | true | false |
| unknown |
| jacktech.jackindia.com | 103.205.143.227 | true | false |
| unknown |
| velma-harber30ku.com | 8.211.4.209 | true | false |
| unknown |
| moumitas.com | 74.208.236.90 | true | false | unknown |
Contacted URLs |
|---|
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown |
URLs from Memory and Binaries |
|---|
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high |
Contacted IPs |
|---|
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
Public |
|---|
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 103.205.143.227 | jacktech.jackindia.com | India | 132335 | NETWORK-LEAPSWITCH-INLeapSwitchNetworksPvtLtdIN | false | |
| 8.211.4.209 | laura9630fr.com | Singapore | 45102 | CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC | true | |
| 74.208.236.90 | moumitas.com | United States | 8560 | ONEANDONE-ASBrauerstrasse48DE | false |
General Information |
|---|
| Joe Sandbox Version: | 31.0.0 Emerald |
| Analysis ID: | 382553 |
| Start date: | 06.04.2021 |
| Start time: | 09:54:17 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 5m 50s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Sample file name: | 12345.xlsm |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Run name: | Potential for more IOCs and behavior |
| Number of analysed new started processes analysed: | 23 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal80.expl.evad.winXLSM@11/12@5/3 |
| EGA Information: | Failed |
| HDC Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
| Warnings: | Show All
|
Simulations |
|---|
Behavior and APIs |
|---|
| No simulations |
|---|
Joe Sandbox View / Context |
|---|
IPs |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 103.205.143.227 | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| 8.211.4.209 | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| 74.208.236.90 | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
Domains |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| laura9630fr.com | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| jacktech.jackindia.com | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| mills-skyla30ec.com | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
ASN |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| NETWORK-LEAPSWITCH-INLeapSwitchNetworksPvtLtdIN | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
JA3 Fingerprints |
|---|
| No context |
|---|
Dropped Files |
|---|
| No context |
|---|
Created / dropped Files |
|---|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 133170 |
| Entropy (8bit): | 5.371011308483069 |
| Encrypted: | false |
| SSDEEP: | 1536:RcQIeNquBXA3gBwqpQ9DQW+zAM34ZldpKWXboOilXNErLdME9:BVQ9DQW+zTXiJ |
| MD5: | D7809C02FD6EB6A22B3E3808C05F1757 |
| SHA1: | 307D3D3608DD6593A52CA0E025AE0262B02C4BB6 |
| SHA-256: | C82D31EFC312252A8190463FDFD61940BB2A1AC94C388497ADE181FE015A8CCA |
| SHA-512: | 817DB548F7E14012A39C160B249B84130AD2CCFEE16B7207078B0B8CA82D1A31E5E6950927512943B88DF0B1BA6CED190459C54FE1CF103CF0140C3CE680C7F4 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8854 |
| Entropy (8bit): | 7.949751503848125 |
| Encrypted: | false |
| SSDEEP: | 192:VS+uZNogNC+NXtYvselFpeBnmMYCft0gVaSgZTaG+3uWYvVZmSGQ9pFT+x5ylxvr:03CbJ+mMYCmgUrNaB3uzvPm1UpFimlxj |
| MD5: | 780FD0ABF9055E2D8FA1BAB6D4B9163E |
| SHA1: | CFCD5C73C9C517161DEC8D4B01ABFCA4B272AEBE |
| SHA-256: | 6A3CDBFDB8911742673C2882E912369BC525A7BD41C9B6EFC5C9A84DAFF6C3B2 |
| SHA-512: | 8359AF512FA5771EB542B1A854F15E74555C7E1F956924520AC6CEBBAE1322D27AC8FBDD390275C5A31223613986B0CBF5871A406CA2DDBB996B9EB7A94E871A |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 848 |
| Entropy (8bit): | 7.595467031611744 |
| Encrypted: | false |
| SSDEEP: | 24:NLJZbn0jL5Q3H/hbqzej+0C3Yi6yyuq53q:JIjm3pQCLWYi67lc |
| MD5: | 02DB1068B56D3FD907241C2F3240F849 |
| SHA1: | 58EC338C879DDBDF02265CBEFA9A2FB08C569D20 |
| SHA-256: | D58FF94F5BB5D49236C138DC109CE83E82879D0D44BE387B0EA3773D908DD25F |
| SHA-512: | 9057CE6FA62F83BB3F3EFAB2E5142ABC41190C08846B90492C37A51F07489F69EDA1D1CA6235C2C8510473E8EA443ECC5694E415AEAF3C7BD07F864212064678 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 557 |
| Entropy (8bit): | 7.343009301479381 |
| Encrypted: | false |
| SSDEEP: | 12:6v/7aLMZ5I9TvSb5Lr6U7+uHK2yJtNJTNSB0qNMQCvGEvfvqVFsSq6ixPT3Zf:Ng8SdCU7+uqF20qNM1dvfSviNd |
| MD5: | A516B6CB784827C6BDE58BC9D341C1BD |
| SHA1: | 9D602E7248E06FF639E6437A0A16EA7A4F9E6C73 |
| SHA-256: | EF8F7EDB6BA0B5ACEC64543A0AF1B133539FFD439F8324634C3F970112997074 |
| SHA-512: | C297A61DA1D7E7F247E14D188C425D43184139991B15A5F932403EE68C356B01879B90B7F96D55B0C9B02F6B9BFAF4E915191683126183E49E668B6049048D35 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8301 |
| Entropy (8bit): | 7.970711494690041 |
| Encrypted: | false |
| SSDEEP: | 192:BzNWXTPmjktA8BddiGGwjNHOQRud4JTTOFPY4:B8aoVT0QNuzWKPh |
| MD5: | D8574C9CC4123EF67C8B600850BE52EE |
| SHA1: | 5547AC473B3523BA2410E04B75E37B1944EE0CCC |
| SHA-256: | ADD8156BAA01E6A9DE10132E57A2E4659B1A8027A8850B8937E57D56A4FC204B |
| SHA-512: | 20D29AF016ED2115C210F4F21C65195F026AAEA14AA16E36FD705482CC31CD26AB78C4C7A344FD11D4E673742E458C2A104A392B28187F2ECCE988B0612DBACF |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 95043 |
| Entropy (8bit): | 7.883576148305342 |
| Encrypted: | false |
| SSDEEP: | 1536:K1+S6bj7lM+z3JFXmuKhIPeKF4PQSVzcTf2haw2bTWPtsmLMWzMNFOfhOJYS6xya:K1ojFjSVzcTfMeT0s+MWzYoUJixJR |
| MD5: | 0D0D1A7DD23BC24920E086576E507CBF |
| SHA1: | 626F3D54BF01283F3EC3487DE5689682353179A9 |
| SHA-256: | A8EEA7EE7F8580044BF95D4F562602B52B7E282CBE868B58DE13785E8CC13A2F |
| SHA-512: | DB77B7351E5D7777B892168B330CDF693E4F91DDC43F75926030581D3B21DA471037B46F89EB6EC83C5189E4536A08E92270CE7F9F87082A27BCF7E37C6E129F |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2066 |
| Entropy (8bit): | 4.701578850950561 |
| Encrypted: | false |
| SSDEEP: | 24:8xWXiVej3AabMfkDJpL7aB6myxWXiVej3AabMfkDJpL7aB6m:8SiQjQaQM0B6pSiQjQaQM0B6 |
| MD5: | 7DA57E2F8133F285FF79DA4278C5FDEA |
| SHA1: | 1BCE0426962E31C6CA1C18C03BD4A45FB74ED2CB |
| SHA-256: | 143F2CD2FB659C5A9D34987659BF491142F8490B760B18546F1DDEB4E4BF8CC3 |
| SHA-512: | 412543211A447DB3310435550123FBB945FB0972B7DACFCCA19ED4D537F0514156E2EF9D404174E7FF072B7BB3B1821247844437912A0C2111E8C194AB1143F6 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 904 |
| Entropy (8bit): | 4.653857077345807 |
| Encrypted: | false |
| SSDEEP: | 12:8jolKXUBduCH2KOMS4Dan+WrjAZ/DYbDJp5SeuSeL44t2Y+xIBjKZm:80tixxAZbcDJpP7aB6m |
| MD5: | 99355C2BE7EC5EB1D5E6E794479357B3 |
| SHA1: | 247D4625E499B223A55E268E67E419AFE19CE3F9 |
| SHA-256: | 5923048905BFC389717AD13EC4283AF23709BF4E845BD98742BC92D3767929FD |
| SHA-512: | DB2B637772056711530C66694642696D1EBA32299C7F69DEDCE32630077A3CF78CF751497E1E0E05554FFB0FB23D07AF2158DF23762463268548061EDAA57FA4 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 70 |
| Entropy (8bit): | 4.450013373778756 |
| Encrypted: | false |
| SSDEEP: | 3:oyBVomxW/LprXC3QLprXCmxW/LprXCv:djALBIQLB+LBs |
| MD5: | 8D90BE2693870D9F8B85B2F981628B31 |
| SHA1: | F1EA8A5440EFA7E99E91415481FC9DD89EF0D2E7 |
| SHA-256: | AD0BDAAB996D0966EF9B85AED4713407724A2889AB06755E43E76103570E7AC9 |
| SHA-512: | 7BE5A626FC0670A5A6BD1B3A50359072D9806736816FFFF0FF25CA244BC931AA5EF4D3B751081202FEAA863AC4A2C6551CF528965DFD7152125C8CABE01609B4 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 22 |
| Entropy (8bit): | 2.9808259362290785 |
| Encrypted: | false |
| SSDEEP: | 3:QAlX0Gn:QKn |
| MD5: | 7962B839183642D3CDC2F9CEBDBF85CE |
| SHA1: | 2BE8F6F309962ED367866F6E70668508BC814C2D |
| SHA-256: | 5EB8655BA3D3E7252CA81C2B9076A791CD912872D9F0447F23F4C4AC4A6514F6 |
| SHA-512: | 2C332AC29FD3FAB66DBD918D60F9BE78B589B090282ED3DBEA02C4426F6627E4AAFC4C13FBCA09EC4925EAC3ED4F8662FDF1D7FA5C9BE714F8A7B993BECB3342 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 95043 |
| Entropy (8bit): | 7.883576148305342 |
| Encrypted: | false |
| SSDEEP: | 1536:K1+S6bj7lM+z3JFXmuKhIPeKF4PQSVzcTf2haw2bTWPtsmLMWzMNFOfhOJYS6xya:K1ojFjSVzcTfMeT0s+MWzYoUJixJR |
| MD5: | 0D0D1A7DD23BC24920E086576E507CBF |
| SHA1: | 626F3D54BF01283F3EC3487DE5689682353179A9 |
| SHA-256: | A8EEA7EE7F8580044BF95D4F562602B52B7E282CBE868B58DE13785E8CC13A2F |
| SHA-512: | DB77B7351E5D7777B892168B330CDF693E4F91DDC43F75926030581D3B21DA471037B46F89EB6EC83C5189E4536A08E92270CE7F9F87082A27BCF7E37C6E129F |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 330 |
| Entropy (8bit): | 1.6081032063576088 |
| Encrypted: | false |
| SSDEEP: | 3:RFXI6dtBhFXI6dtt:RJZhJ1 |
| MD5: | 836727206447D2C6B98C973E058460C9 |
| SHA1: | D83351CF6DE78FEDE0142DE5434F9217C4F285D2 |
| SHA-256: | D9BECB14EECC877F0FA39B6B6F856365CADF730B64E7FA2163965D181CC5EB41 |
| SHA-512: | 7F843EDD7DC6230BF0E05BF988D25AE6188F8B22808F2C990A1E8039C0CECC25D1D101E0FDD952722FEAD538F7C7C14EEF9FD7F4B31036C3E7F79DE570CD0607 |
| Malicious: | true |
| Preview: |
|
Static File Info |
|---|
General | |
|---|---|
| File type: | |
| Entropy (8bit): | 7.884862176121338 |
| TrID: |
|
| File name: | 12345.xlsm |
| File size: | 95672 |
| MD5: | 5851c6423d6cffdbfdd9ce4276592acb |
| SHA1: | 8992a00647a35e67a887127b5aa7269cc9c597c6 |
| SHA256: | a7893081be92e7c0c1672482df252f282abca98ff09ff559f246bcc5244d74c3 |
| SHA512: | 8a9510adb6020f887e4fa134fe8dc9df394bf055a7c596057ca92e582f72508da624c8072ad73488d8112b402360fcc4d1e4c381ecd247c06b450c17fcd737f3 |
| SSDEEP: | 1536:Qb/ndoJz+kgpei9EM5fybX8dz+HAITWPtsmLMWzMNFOfhOJYS6xybsD9fe2hawZ+:QbpJ5fybX8dz+HzT0s+MWzYoUJixzWMo |
| File Content Preview: | PK..........!...`.............[Content_Types].xml ...(......................................................................................................................................................................................................... |
File Icon |
|---|
 | |
| Icon Hash: | 74ecd0e2f696908c |
Static OLE Info |
|---|
General | ||
|---|---|---|
| Document Type: | OpenXML | |
| Number of OLE Files: | 1 | |
OLE File "12345.xlsm" |
|---|
Indicators | |
|---|---|
| Has Summary Info: | |
| Application Name: | |
| Encrypted Document: | |
| Contains Word Document Stream: | |
| Contains Workbook/Book Stream: | |
| Contains PowerPoint Document Stream: | |
| Contains Visio Document Stream: | |
| Contains ObjectPool Stream: | |
| Flash Objects Count: | |
| Contains VBA Macros: | |
Macro 4.0 Code |
|---|
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeNetwork Behavior |
|---|
Network Port Distribution |
|---|
TCP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Apr 6, 2021 09:55:14.431035042 CEST | 49730 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:14.469472885 CEST | 80 | 49730 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:14.469556093 CEST | 49730 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:14.470207930 CEST | 49730 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:14.551409960 CEST | 80 | 49730 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:14.891041040 CEST | 80 | 49730 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:14.891124964 CEST | 49730 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:14.891271114 CEST | 80 | 49730 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:14.891323090 CEST | 49730 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:14.891416073 CEST | 49730 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:14.929661989 CEST | 80 | 49730 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:14.964786053 CEST | 49732 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:15.003367901 CEST | 80 | 49732 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:15.003482103 CEST | 49732 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:15.004120111 CEST | 49732 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:15.083641052 CEST | 80 | 49732 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:15.408405066 CEST | 80 | 49732 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:15.408639908 CEST | 49732 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:15.408811092 CEST | 49732 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:15.447252035 CEST | 80 | 49732 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:15.779066086 CEST | 49734 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:15.817545891 CEST | 80 | 49734 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:15.817676067 CEST | 49734 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:15.818351984 CEST | 49734 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:15.899563074 CEST | 80 | 49734 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:16.223596096 CEST | 80 | 49734 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:16.223624945 CEST | 80 | 49734 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:16.223752022 CEST | 49734 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:16.223865986 CEST | 49734 | 80 | 192.168.2.4 | 8.211.4.209 |
| Apr 6, 2021 09:55:16.262239933 CEST | 80 | 49734 | 8.211.4.209 | 192.168.2.4 |
| Apr 6, 2021 09:55:16.315769911 CEST | 49735 | 80 | 192.168.2.4 | 74.208.236.90 |
| Apr 6, 2021 09:55:16.476035118 CEST | 80 | 49735 | 74.208.236.90 | 192.168.2.4 |
| Apr 6, 2021 09:55:16.476387978 CEST | 49735 | 80 | 192.168.2.4 | 74.208.236.90 |
| Apr 6, 2021 09:55:16.477008104 CEST | 49735 | 80 | 192.168.2.4 | 74.208.236.90 |
| Apr 6, 2021 09:55:16.637166023 CEST | 80 | 49735 | 74.208.236.90 | 192.168.2.4 |
| Apr 6, 2021 09:55:16.725126028 CEST | 80 | 49735 | 74.208.236.90 | 192.168.2.4 |
| Apr 6, 2021 09:55:16.725270033 CEST | 49735 | 80 | 192.168.2.4 | 74.208.236.90 |
| Apr 6, 2021 09:55:16.726073980 CEST | 49735 | 80 | 192.168.2.4 | 74.208.236.90 |
| Apr 6, 2021 09:55:16.730202913 CEST | 80 | 49735 | 74.208.236.90 | 192.168.2.4 |
| Apr 6, 2021 09:55:16.730330944 CEST | 49735 | 80 | 192.168.2.4 | 74.208.236.90 |
| Apr 6, 2021 09:55:16.801307917 CEST | 49736 | 80 | 192.168.2.4 | 103.205.143.227 |
| Apr 6, 2021 09:55:16.889584064 CEST | 80 | 49735 | 74.208.236.90 | 192.168.2.4 |
| Apr 6, 2021 09:55:16.889693022 CEST | 49735 | 80 | 192.168.2.4 | 74.208.236.90 |
| Apr 6, 2021 09:55:17.000811100 CEST | 80 | 49736 | 103.205.143.227 | 192.168.2.4 |
| Apr 6, 2021 09:55:17.000957012 CEST | 49736 | 80 | 192.168.2.4 | 103.205.143.227 |
| Apr 6, 2021 09:55:17.001710892 CEST | 49736 | 80 | 192.168.2.4 | 103.205.143.227 |
| Apr 6, 2021 09:55:17.199371099 CEST | 80 | 49736 | 103.205.143.227 | 192.168.2.4 |
| Apr 6, 2021 09:55:17.751396894 CEST | 80 | 49736 | 103.205.143.227 | 192.168.2.4 |
| Apr 6, 2021 09:55:17.751528978 CEST | 49736 | 80 | 192.168.2.4 | 103.205.143.227 |
| Apr 6, 2021 09:55:28.210486889 CEST | 80 | 49736 | 103.205.143.227 | 192.168.2.4 |
| Apr 6, 2021 09:55:28.210563898 CEST | 49736 | 80 | 192.168.2.4 | 103.205.143.227 |
| Apr 6, 2021 09:56:59.966986895 CEST | 49736 | 80 | 192.168.2.4 | 103.205.143.227 |
| Apr 6, 2021 09:57:00.497221947 CEST | 49736 | 80 | 192.168.2.4 | 103.205.143.227 |
| Apr 6, 2021 09:57:01.481533051 CEST | 49736 | 80 | 192.168.2.4 | 103.205.143.227 |
| Apr 6, 2021 09:57:03.451226950 CEST | 49736 | 80 | 192.168.2.4 | 103.205.143.227 |
| Apr 6, 2021 09:57:07.372733116 CEST | 49736 | 80 | 192.168.2.4 | 103.205.143.227 |
| Apr 6, 2021 09:57:15.201550961 CEST | 49736 | 80 | 192.168.2.4 | 103.205.143.227 |
UDP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Apr 6, 2021 09:54:56.057313919 CEST | 53723 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:54:56.106487036 CEST | 53 | 53723 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:54:56.439960003 CEST | 64646 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:54:56.491002083 CEST | 53 | 64646 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:54:56.700411081 CEST | 65298 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:54:56.749491930 CEST | 53 | 65298 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:54:57.424484968 CEST | 59123 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:54:57.472316980 CEST | 53 | 59123 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:54:59.781480074 CEST | 54531 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:54:59.830004930 CEST | 53 | 54531 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:00.887706995 CEST | 49714 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:00.935883045 CEST | 53 | 49714 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:01.828459024 CEST | 58028 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:01.874355078 CEST | 53 | 58028 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:02.233068943 CEST | 53097 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:02.294461966 CEST | 53 | 53097 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:08.799714088 CEST | 49257 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:08.845710039 CEST | 53 | 49257 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:10.006622076 CEST | 62389 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:10.085582972 CEST | 53 | 62389 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:10.422192097 CEST | 49910 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:10.468363047 CEST | 53 | 49910 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:10.521728039 CEST | 55854 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:10.576072931 CEST | 53 | 55854 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:11.520768881 CEST | 55854 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:11.575422049 CEST | 53 | 55854 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:12.535201073 CEST | 55854 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:12.602499008 CEST | 53 | 55854 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:14.374536037 CEST | 64549 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:14.428766012 CEST | 53 | 64549 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:14.491508961 CEST | 63153 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:14.537358046 CEST | 53 | 63153 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:14.551110029 CEST | 55854 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:14.597151995 CEST | 53 | 55854 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:14.904489994 CEST | 52991 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:14.962584019 CEST | 53 | 52991 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:15.422574997 CEST | 53700 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:15.711530924 CEST | 51726 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:15.757831097 CEST | 53 | 51726 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:15.776949883 CEST | 53 | 53700 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:16.259332895 CEST | 56794 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:16.313508987 CEST | 53 | 56794 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:16.741473913 CEST | 56534 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:16.798671007 CEST | 53 | 56534 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:18.567047119 CEST | 55854 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:18.623831987 CEST | 53 | 55854 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:29.809089899 CEST | 56627 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:29.856167078 CEST | 53 | 56627 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:34.174314022 CEST | 56621 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:34.233164072 CEST | 53 | 56621 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:47.339354992 CEST | 63116 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:47.385590076 CEST | 53 | 63116 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:48.231545925 CEST | 64078 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:48.286077976 CEST | 53 | 64078 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:55:51.891438007 CEST | 64801 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:55:51.937288046 CEST | 53 | 64801 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:06.653248072 CEST | 61721 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:06.699546099 CEST | 53 | 61721 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:09.238087893 CEST | 51255 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:09.293976068 CEST | 53 | 51255 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:19.386142969 CEST | 61522 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:19.432065964 CEST | 53 | 61522 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:20.399442911 CEST | 52337 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:20.449572086 CEST | 53 | 52337 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:44.248491049 CEST | 55046 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:44.382529974 CEST | 53 | 55046 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:45.783363104 CEST | 49612 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:45.913228989 CEST | 53 | 49612 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:46.552134991 CEST | 49285 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:46.609467983 CEST | 53 | 49285 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:47.093302965 CEST | 50601 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:47.155508995 CEST | 53 | 50601 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:47.921578884 CEST | 60875 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:47.975783110 CEST | 53 | 60875 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:48.615324020 CEST | 56448 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:48.672681093 CEST | 53 | 56448 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:49.461865902 CEST | 59172 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:49.516123056 CEST | 53 | 59172 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:50.241547108 CEST | 62420 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:50.290854931 CEST | 53 | 62420 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:50.532402992 CEST | 60579 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:50.587022066 CEST | 53 | 60579 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:51.271948099 CEST | 50183 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:51.321423054 CEST | 53 | 50183 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:52.329005003 CEST | 61531 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:52.386246920 CEST | 53 | 61531 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:54.988344908 CEST | 49228 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:55.035957098 CEST | 53 | 49228 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:55.196751118 CEST | 59794 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:55.251498938 CEST | 53 | 59794 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:55.959295034 CEST | 55916 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:56.036698103 CEST | 53 | 55916 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:56.070770025 CEST | 52752 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:56.117073059 CEST | 53 | 52752 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:56.252897024 CEST | 60542 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:56.320879936 CEST | 53 | 60542 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:57.476695061 CEST | 60689 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:57.522500038 CEST | 53 | 60689 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:56:58.360049009 CEST | 64206 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:56:58.406126022 CEST | 53 | 64206 | 8.8.8.8 | 192.168.2.4 |
| Apr 6, 2021 09:57:22.603830099 CEST | 50904 | 53 | 192.168.2.4 | 8.8.8.8 |
| Apr 6, 2021 09:57:22.650999069 CEST | 53 | 50904 | 8.8.8.8 | 192.168.2.4 |
DNS Queries |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class |
|---|---|---|---|---|---|---|---|
| Apr 6, 2021 09:55:14.374536037 CEST | 192.168.2.4 | 8.8.8.8 | 0x76cc | Standard query (0) | A (IP address) | IN (0x0001) | |
| Apr 6, 2021 09:55:14.904489994 CEST | 192.168.2.4 | 8.8.8.8 | 0x9c5d | Standard query (0) | A (IP address) | IN (0x0001) | |
| Apr 6, 2021 09:55:15.422574997 CEST | 192.168.2.4 | 8.8.8.8 | 0xa84a | Standard query (0) | A (IP address) | IN (0x0001) | |
| Apr 6, 2021 09:55:16.259332895 CEST | 192.168.2.4 | 8.8.8.8 | 0x69f1 | Standard query (0) | A (IP address) | IN (0x0001) | |
| Apr 6, 2021 09:55:16.741473913 CEST | 192.168.2.4 | 8.8.8.8 | 0x23b9 | Standard query (0) | A (IP address) | IN (0x0001) |
DNS Answers |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class |
|---|---|---|---|---|---|---|---|---|---|
| Apr 6, 2021 09:55:14.428766012 CEST | 8.8.8.8 | 192.168.2.4 | 0x76cc | No error (0) | 8.211.4.209 | A (IP address) | IN (0x0001) | ||
| Apr 6, 2021 09:55:14.962584019 CEST | 8.8.8.8 | 192.168.2.4 | 0x9c5d | No error (0) | 8.211.4.209 | A (IP address) | IN (0x0001) | ||
| Apr 6, 2021 09:55:15.776949883 CEST | 8.8.8.8 | 192.168.2.4 | 0xa84a | No error (0) | 8.211.4.209 | A (IP address) | IN (0x0001) | ||
| Apr 6, 2021 09:55:16.313508987 CEST | 8.8.8.8 | 192.168.2.4 | 0x69f1 | No error (0) | 74.208.236.90 | A (IP address) | IN (0x0001) | ||
| Apr 6, 2021 09:55:16.798671007 CEST | 8.8.8.8 | 192.168.2.4 | 0x23b9 | No error (0) | 103.205.143.227 | A (IP address) | IN (0x0001) |
HTTP Request Dependency Graph |
|---|
|
HTTP Packets |
|---|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49730 | 8.211.4.209 | 80 | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Apr 6, 2021 09:55:14.470207930 CEST | 1496 | OUT | |
| Apr 6, 2021 09:55:14.891041040 CEST | 1584 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49732 | 8.211.4.209 | 80 | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Apr 6, 2021 09:55:15.004120111 CEST | 1590 | OUT | |
| Apr 6, 2021 09:55:15.408405066 CEST | 1654 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49734 | 8.211.4.209 | 80 | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Apr 6, 2021 09:55:15.818351984 CEST | 1764 | OUT | |
| Apr 6, 2021 09:55:16.223596096 CEST | 1870 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49735 | 74.208.236.90 | 80 | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Apr 6, 2021 09:55:16.477008104 CEST | 1874 | OUT | |
| Apr 6, 2021 09:55:16.725126028 CEST | 1991 | IN | |
| Apr 6, 2021 09:55:16.730202913 CEST | 1994 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | Process |
|---|---|---|---|---|---|
| 4 | 192.168.2.4 | 49736 | 103.205.143.227 | 80 | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| Timestamp | kBytes transferred | Direction | Data |
|---|---|---|---|
| Apr 6, 2021 09:55:17.001710892 CEST | 2075 | OUT | |
| Apr 6, 2021 09:55:17.751396894 CEST | 2409 | IN |
Code Manipulations |
|---|
Statistics |
|---|
CPU Usage |
|---|
Click to jump to process
Memory Usage |
|---|
Click to jump to process
High Level Behavior Distribution |
|---|
back
Click to dive into process behavior distribution
Behavior |
|---|
Click to jump to process
System Behavior |
|---|
General |
|---|
| Start time: | 09:55:08 |
| Start date: | 06/04/2021 |
| Path: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x60000 |
| File size: | 27110184 bytes |
| MD5 hash: | 5D6638F2C8F8571C593999C58866007E |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 09:55:17 |
| Start date: | 06/04/2021 |
| Path: | C:\Windows\SysWOW64\regsvr32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1160000 |
| File size: | 20992 bytes |
| MD5 hash: | 426E7499F6A7346F0410DEAD0805586B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 09:55:18 |
| Start date: | 06/04/2021 |
| Path: | C:\Windows\SysWOW64\regsvr32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1160000 |
| File size: | 20992 bytes |
| MD5 hash: | 426E7499F6A7346F0410DEAD0805586B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 09:55:18 |
| Start date: | 06/04/2021 |
| Path: | C:\Windows\SysWOW64\regsvr32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1160000 |
| File size: | 20992 bytes |
| MD5 hash: | 426E7499F6A7346F0410DEAD0805586B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 09:55:19 |
| Start date: | 06/04/2021 |
| Path: | C:\Windows\SysWOW64\regsvr32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1160000 |
| File size: | 20992 bytes |
| MD5 hash: | 426E7499F6A7346F0410DEAD0805586B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 09:55:21 |
| Start date: | 06/04/2021 |
| Path: | C:\Windows\SysWOW64\regsvr32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1160000 |
| File size: | 20992 bytes |
| MD5 hash: | 426E7499F6A7346F0410DEAD0805586B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
Disassembly |
|---|
Code Analysis |
|---|