Analysis Report 8100c344_by_Libranalysis.xls

Overview

General Information

Sample Name:	8100c344_by_Libranalysis.xls
Analysis ID:	412222
MD5:	8100c34499827f8ba4a0c69872cd2205
SHA1:	4c7ee8ed850c211c66102389a65b0757018d1168
SHA256:	abb73bd58ba634f647ed144b998f9a829c69ad6410011a42147311459ed563e4
Infos:
Most interesting Screenshot:

Detection

Hidden Macro 4.0

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Found Excel 4.0 Macro with suspicious formulas

Found abnormal large hidden Excel 4.0 Macro sheet

Sigma detected: Microsoft Office Product Spawning Windows Shell

Document contains embedded VBA macros

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 192.185.39.58:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.32.232:443 -> 192.168.2.4:49738 version: TLS 1.2

Software Vulnerabilities:

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Section loaded: unknown origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\rundll32.exe

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: signifysystem.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 192.185.39.58:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 192.185.39.58:443

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 192.185.39.58 192.185.39.58
Source: Joe Sandbox View	IP Address: 192.185.32.232 192.185.32.232

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS traffic detected: queries for: signifysystem.com

Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.cortana.ai
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.office.net
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.onedrive.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://augloop.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cdn.entity.
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cortana.ai
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cortana.ai/api
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cr.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://directory.services.
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://graph.windows.net
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://graph.windows.net/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://login.windows.local
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://management.azure.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://management.azure.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://messaging.office.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://officeapps.live.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://onedrive.live.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://outlook.office.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://settings.outlook.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://tasks.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 192.185.39.58:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.32.232:443 -> 192.168.2.4:49738 version: TLS 1.2

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing 11 from the yellow bar above RunDLL X 12 13 Once You have Enable Editing, plee T
Source: Screenshot number: 8	Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing, please click Enable Conte
Source: Screenshot number: 8	Screenshot OCR: Enable Content from the yellow bar above WHY I CANNOT OPEN THIS DOCUMENT ? W You are using iOS or
Source: Document image extraction number: 5	Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing, please click Enable Content
Source: Document image extraction number: 5	Screenshot OCR: Enable Content from the yellow bar above WHY I CANNOT OPEN THIS DOCUMENT? You are using iOS or An
Source: Document image extraction number: 14	Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing, please click Enable Conte
Source: Document image extraction number: 14	Screenshot OCR: Enable Content from the yellow bar above WHY I CANNOT OPEN THIS DOCUMENT? w You are using IDS or

Found Excel 4.0 Macro with suspicious formulas

Source: 8100c344_by_Libranalysis.xls	Initial sample: CALL
Source: 8100c344_by_Libranalysis.xls	Initial sample: CALL
Source: 8100c344_by_Libranalysis.xls	Initial sample: EXEC

Found abnormal large hidden Excel 4.0 Macro sheet

Source: 8100c344_by_Libranalysis.xls

Initial sample: Sheet size: 14902

Document contains embedded VBA macros

Source: 8100c344_by_Libranalysis.xls

OLE indicator, VBA macros: true

Source: classification engine

Classification label: mal68.expl.evad.winXLS@5/7@2/2

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{765CB870-138F-4FBD-9C99-DF1A0E1974DB} - OProcSessId.dat

Jump to behavior

Source: 8100c344_by_Libranalysis.xls

OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\ritofm.cvm,DllRegisterServer

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\ritofm.cvm,DllRegisterServer
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\ritofm.cvm1,DllRegisterServer
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\ritofm.cvm,DllRegisterServer	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\ritofm.cvm1,DllRegisterServer	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.185.39.58	signifysystem.com	United States		46606	UNIFIEDLAYER-AS-1US	false
192.185.32.232	fcventasyservicios.cl	United States		46606	UNIFIEDLAYER-AS-1US	false

Contacted Domains

Name	IP	Active
signifysystem.com	192.185.39.58	true
fcventasyservicios.cl	192.185.32.232	true

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 192.185.39.58:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.32.232:443 -> 192.168.2.4:49738 version: TLS 1.2

Software Vulnerabilities:

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Section loaded: unknown origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\rundll32.exe

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: signifysystem.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 192.185.39.58:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 192.185.39.58:443

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 192.185.39.58 192.185.39.58
Source: Joe Sandbox View	IP Address: 192.185.32.232 192.185.32.232

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS traffic detected: queries for: signifysystem.com

Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.cortana.ai
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.office.net
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.onedrive.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://augloop.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cdn.entity.
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cortana.ai
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cortana.ai/api
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://cr.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://directory.services.
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://graph.windows.net
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://graph.windows.net/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://login.windows.local
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://management.azure.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://management.azure.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://messaging.office.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://officeapps.live.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://onedrive.live.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://outlook.office.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://settings.outlook.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://tasks.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: BFE22172-59BF-4A95-AA18-3650190CBF48.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 192.185.39.58:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.32.232:443 -> 192.168.2.4:49738 version: TLS 1.2

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing 11 from the yellow bar above RunDLL X 12 13 Once You have Enable Editing, plee T
Source: Screenshot number: 8	Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing, please click Enable Conte
Source: Screenshot number: 8	Screenshot OCR: Enable Content from the yellow bar above WHY I CANNOT OPEN THIS DOCUMENT ? W You are using iOS or
Source: Document image extraction number: 5	Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing, please click Enable Content
Source: Document image extraction number: 5	Screenshot OCR: Enable Content from the yellow bar above WHY I CANNOT OPEN THIS DOCUMENT? You are using iOS or An
Source: Document image extraction number: 14	Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing, please click Enable Conte
Source: Document image extraction number: 14	Screenshot OCR: Enable Content from the yellow bar above WHY I CANNOT OPEN THIS DOCUMENT? w You are using IDS or

Found Excel 4.0 Macro with suspicious formulas

Source: 8100c344_by_Libranalysis.xls	Initial sample: CALL
Source: 8100c344_by_Libranalysis.xls	Initial sample: CALL
Source: 8100c344_by_Libranalysis.xls	Initial sample: EXEC

Found abnormal large hidden Excel 4.0 Macro sheet

Source: 8100c344_by_Libranalysis.xls

Initial sample: Sheet size: 14902

Document contains embedded VBA macros

Source: 8100c344_by_Libranalysis.xls

OLE indicator, VBA macros: true

Source: classification engine

Classification label: mal68.expl.evad.winXLS@5/7@2/2

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{765CB870-138F-4FBD-9C99-DF1A0E1974DB} - OProcSessId.dat

Jump to behavior

Source: 8100c344_by_Libranalysis.xls

OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\ritofm.cvm,DllRegisterServer

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\ritofm.cvm,DllRegisterServer
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\ritofm.cvm1,DllRegisterServer
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\ritofm.cvm,DllRegisterServer	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\ritofm.cvm1,DllRegisterServer	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

ID:	412222
Product:	CloudBasic
Start time:	14:16:33
Start date:	12.05.2021
Sample:	8100c344_by_Libranalysis.xls
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	8100c34499827f8ba4a0c69872cd2205
SHA1:	4c7ee8ed850c211c66102389a65b0757018d1168
SHA256:	abb73bd58ba634f647ed144b998f9a829c69ad6410011a42147311459ed563e4
Filetype:	Microsoft Excel sheet (30009/1) 78.94%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\BFE22172-59BF-4A95-AA18-3650190CBF48	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	24A04DA77EA2DFCDB0FE13E4DA43CC19	10846543AA8F0F31F0D03B8C4D3ACD92F7834CB9	D347ADCC141C9EBC9E756EA044B28E10D6E51EB8C9B27795F02BB305AC800233
C:\Users\user\AppData\Local\Temp\55D40000	data	203893E2D568F581EF880AC7D03533E9	C3FAF10A9D229DE1990F296C30C51518C6559DB7	578AE58B902F0267C984374FDFF2105D7B7153C68D07B44CF2BB2DD92ACA4608
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\8100c344_by_Libranalysis.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 06:35:56 2020, mtime=Wed May 12 11:17:37 2021, atime=Wed May 12 11:17:37 2021, length=177152, window=hide	ACBC472B9470C39B3015B65ACE5CA380	57F7E259530467906A579CD82096F121339F3BB1	2B4C47B8018D18FA3C66EBCBF81998FF00D2CC10F5EC6F4D4E7DB421467682BF
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Thu Jun 27 17:12:41 2019, mtime=Wed May 12 11:17:36 2021, atime=Wed May 12 11:17:36 2021, length=8192, window=hide	EBAC0D6C700341304AE6B2024F1E1A4C	06D18C6DAA3B63919B8BA9BA9C3995435C62E68D	52BF9CD851546F145BCED939D2A0C64E2E925744A937015402253C7DF165810B
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	50A264AB5F2F3DD403E9167C4A6AD10C	DA0CA2A03E1F86767F74690EB06E0D3025FD7298	76C923D77D8A498EE2AD8C6CC63C37F82A2811457DF4DF7A8C0FADDDA5AE26B4
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC	Little-endian UTF-16 Unicode text, with CR line terminators	7962B839183642D3CDC2F9CEBDBF85CE	2BE8F6F309962ED367866F6E70668508BC814C2D	5EB8655BA3D3E7252CA81C2B9076A791CD912872D9F0447F23F4C4AC4A6514F6
C:\Users\user\Desktop\56D40000	Applesoft BASIC program data, first line number 16	88A1DD556FE7441D8F4ACC18DD465F14	201A1DC8246AFEDB384FA6158CC70990BFC2C33F	6FA3DFF7EC76581E9A4160F6A28B95E9FFD3A915F6F346804236BC93A03DA42B

Analysis Report 8100c344_by_Libranalysis.xls

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains