flash

Rechnungsbeleg.xlsm

Status: finished
Submission Time: 26.08.2020 15:24:44
Malicious
Trojan
Spyware
Exploiter
Evader
FormBook GuLoader

Comments

Tags

  • DEU
  • FormBook
  • geo
  • GuLoader
  • xlsm

Details

  • Analysis ID:
    278329
  • API (Web) ID:
    451624
  • Analysis Started:
    27.08.2020 02:48:47
  • Analysis Finished:
    27.08.2020 03:01:05
  • MD5:
    13d68c90dfd6581f051e7cd69170d6b9
  • SHA1:
    5637ff31e6eecaf0d6bfc20caa8ae4adde8dd69c
  • SHA256:
    e02e2804d98658cc76ef89c09f52f66843e68cb94f7578f1ff856aa4999a3c19
  • Technologies:
Full Report Engine Info Verdict Score Reports

malicious

System: w10x64 Windows 10 64 bit v1803 with Office Professional Plus 2016, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
31/69

malicious
10/48

malicious

IPs

IP Country Detection
192.64.119.224
United States
64.32.22.102
United States

Domains

Name IP Detection
www.equifaxsecurity.com
192.64.119.224
www.getscholardollars.com
0.0.0.0
parking.namesilo.com
64.32.22.102
Click to see the 4 hidden entries
www.nabwallet.com
23.224.11.66
6lyy0a.am.files.1drv.com
0.0.0.0
onedrive.live.com
0.0.0.0
6lzhcg.am.files.1drv.com
0.0.0.0

URLs

Name Detection
http://www.equifaxsecurity.com/d2w/?pvj01lRX=/65nfF/Nxm10NrnhIxqp1OrccA5CCv2C4tVcC1Dq4jiYYSyOmWBHNW0BaFzMFPrna1Df&FD=9rX8FzT0
https://onedrive.live.com/download?cid=18579953F243D979&resid=18579953F243D979%21125&authkey=AI1EUE6
https://powerlift.acompli.net
Click to see the 97 hidden entries
https://rpsticket.partnerservices.getmicrosoftkey.com
https://lookup.onenote.com/lookup/geolocation/v1
https://cortana.ai
http://www.fontbureau.com/designers
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
https://cloudfiles.onenote.com/upload.aspx
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
https://entitlement.diagnosticssdf.office.com
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
https://onedrive.live.com/
https://api.aadrm.com/
http://www.sajatypeworks.com
https://ofcrecsvcapi-int.azurewebsites.net/
http://www.founder.com.cn/cn/cThe
http://onedrive.live.com/download?cid=18579953F243D979&resid=18579953F243D979%21126&authkey=AIuP0x-y
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
https://api.microsoftstream.com/api/
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
https://cr.office.com
http://www.galapagosdesign.com/DPlease
http://www.urwpp.deDPlease
http://www.zhongyicts.com.cn
https://portal.office.com/account/?ref=ClientMeControl
https://ecs.office.com/config/v2/Office
https://graph.ppe.windows.net
https://res.getmicrosoftkey.com/api/redemptionevents
https://powerlift-frontdesk.acompli.net
https://tasks.office.com
https://officeci.azurewebsites.net/api/
https://sr.outlook.office.net/ws/speech/recognize/assistant/work
https://store.office.cn/addinstemplate
https://wus2-000.pagecontentsync.
https://outlook.office.com/autosuggest/api/v1/init?cvid=
https://globaldisco.crm.dynamics.com
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
https://store.officeppe.com/addinstemplate
https://dev0-api.acompli.net/autodetect
https://www.odwebp.svc.ms
https://api.powerbi.com/v1.0/myorg/groups
https://web.microsoftstream.com/video/
https://graph.windows.net
https://dataservice.o365filtering.com/
https://officesetup.getmicrosoftkey.com
https://analysis.windows.net/powerbi/api
http://www.carterandcone.coml
https://prod-global-autodetect.acompli.net/autodetect
http://www.fontbureau.com/designers/frere-jones.html
https://outlook.office365.com/autodiscover/autodiscover.json
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
http://weather.service.msn.com/data.aspx
https://apis.live.net/v5.0/
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
https://management.azure.com
http://www.fontbureau.com/designersG
https://incidents.diagnostics.office.com
http://www.fontbureau.com/designers/?
http://www.founder.com.cn/cn/bThe
https://clients.config.office.net/user/v1.0/ios
http://www.fontbureau.com/designers?
https://insertmedia.bing.office.net/odc/insertmedia
https://o365auditrealtimeingestion.manage.office.com
https://outlook.office365.com/api/v1.0/me/Activities
https://incidents.diagnosticssdf.office.com
http://www.tiro.com
https://asgsmsproxyapi.azurewebsites.net/
https://clients.config.office.net/user/v1.0/android/policies
https://entitlement.diagnostics.office.com
http://www.goodfont.co.kr
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
https://storage.live.com/clientlogs/uploadlocation
http://www.typography.netD
https://templatelogging.office.com/client/log
http://www.galapagosdesign.com/staff/dennis.htm
http://fontfabrik.com
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
https://management.azure.com/
https://ncus-000.contentsync.
https://login.windows.net/common/oauth2/authorize
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
http://www.fonts.com
http://www.sandoll.co.kr
https://graph.windows.net/
https://api.diagnosticssdf.office.com
https://login.microsoftonline.com/
https://shell.suite.office.com:1443
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
https://cdn.entity.
https://wus2-000.contentsync.
https://clients.config.office.net/user/v1.0/tenantassociationkey
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\svchost.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Roaming\O38QPC87\O38logri.ini
data
#
C:\Users\user\AppData\Roaming\O38QPC87\O38logrv.ini
data
#
Click to see the 10 hidden entries
C:\Users\user\Desktop\~$Rechnungsbeleg.xlsm
data
#
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\EC5C2C29-06EF-4C12-B137-58A90FC5C25F
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5E625310.jpg
[TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS4 Windows, datetime=2020:07:29 09:25:49], baseline, precision 8, 1365x657, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_afcfoirl.rxm.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jr204mxa.fug.ps1
very short file (no magic)
#
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Little-endian UTF-16 Unicode text, with CR line terminators
#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WIFIODS7CZ6WSRFGY7ZG.temp
data
#
C:\Users\user\AppData\Roaming\O38QPC87\O38logim.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
#
C:\Users\user\Documents\20200827\PowerShell_transcript.128757.J4I_YvVX.20200827024953.txt
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
#