flash

841975.xls

Status: finished
Submission Time: 16.10.2020 03:36:53
Malicious
Exploiter
Evader
Hidden Macro 4.0

Comments

Tags

Details

  • Analysis ID:
    298998
  • API (Web) ID:
    493098
  • Analysis Started:
    16.10.2020 03:36:54
  • Analysis Finished:
    16.10.2020 03:41:56
  • MD5:
    005443a3eb1d449484b88f6f527f6bc3
  • SHA1:
    4b9abe98268f1a558b5860789ef8e1f8035cec6c
  • SHA256:
    24c24f193931c2431fda0840e71011f5b249e8ade79f1766d28d0d8464c36871
  • Technologies:
Full Report Management Report Engine Info Verdict Score Reports

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
80/100

IPs

IP Country Detection
159.65.125.229
United States
153.2.224.50
United States

Domains

Name IP Detection
hellomydad.xyz
159.65.125.229
ups.com
153.2.224.50
www.ups.com
0.0.0.0

URLs

Name Detection
https://www.ups.com/vn/en/Home.page
https://www.ups.com/mx/es/Home.page
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Click to see the 97 hidden entries
https://www.ups.com/et/en/Home.page
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
http://weather.service.msn.com/data.aspx
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
https://www.ups.com/dk/da/Home.page
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
https://www.ups.com/ch/de/Home.page
https://www.ups.com/ph/en/Home.page
https://o365auditrealtimeingestion.manage.office.com
https://www.ups.com/pt/en/Home.page
https://outlook.office365.com/api/v1.0/me/Activities
https://clients.config.office.net/user/v1.0/android/policies
https://www.ups.com/ms/en/Home.page
https://www.ups.com/mo/en/Home.page
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
https://www.ups.com/si/en/Home.page
https://www.ups.com/al/en/Home.page
https://www.ups.com/hk/zh/Home.page
https://www.ups.com/rw/en/Home.page
https://www.ups.com/ge/en/Home.page
https://www.ups.com/ba/en/Home.page
https://www.ups.com/xe/en/Home.page
https://www.ups.com/gf/en/Home.page
https://ups.inq.com/chatskins/launch/inqChatLaunch10005649.js
https://www.ups.com/gi/en/Home.page
https://www.ups.com/xa/en/Home.page
https://devnull.onenote.com
https://www.ups.com/bm/en/Home.page
https://www.ups.com/lr/en/Home.page
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
https://skyapi.live.net/Activity/
https://www.ups.com/se/sv/Home.page
https://www.ups.com/fi/en/Home.page
https://visio.uservoice.com/forums/368202-visio-on-devices
https://onedrive.live.com/embed?
https://augloop.office.com
https://www.ups.com/gu/en/Home.page
https://www.ups.com/ee/en/Home.page
https://www.ups.com/gy/en/Home.page
https://www.ups.com/pw/en/Home.page
https://www.ups.com/at/de/Home.page
https://www.ups.com/sl/en/Home.page
https://www.ups.com/hn/es/Home.page
https://www.ups.com/il/iw/Home.page
https://www.ups.com/bg/bg/Home.page
https://www.ups.com/lc/en/Home.page
https://www.ups.com/doapp/SignUp?loc=en_US&ClientId=18&returnto=https%3A%2F%2Fwww.ups.com%2Fus%2Fen%
https://www.ups.com/kn/en/Home.page
https://www.ups.com/ca/en/Home.page
https://www.ups.com/ma/en/Home.page
https://s2.go-mpulse.net/boomerang/
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
https://www.ups.com/mq/en/Home.page
https://www.ups.com/xs/en/Home.page
https://rpsticket.partnerservices.getmicrosoftkey.com
https://lookup.onenote.com/lookup/geolocation/v1
https://www.ups.com/pf/en/Home.page
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
https://www.ups.com/sk/en/Home.page
https://www.ups.com/ve/es/Home.page
https://www.ups.com/us/en/global.page
https://www.ups.com/ru/ru/Home.page
https://www.ups.com/xc/en/Home.page
https://www.ups.com/gh/en/Home.page
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
https://www.ups.com/nc/en/Home.page
https://www.ups.com/yt/en/Home.page
https://www.ups.com/bo/en/Home.page
https://www.ups.com/tm/en/Home.page
https://www.ups.com/cz/cs/Home.page
https://www.ups.com/cr/en/Home.page
https://res.getmicrosoftkey.com/api/redemptionevents
https://tasks.office.com
https://www.ups.com/km/en/Home.page
https://www.ups.com/zw/en/Home.page
https://www.ups.com/mb/en/Home.page
https://ups6.custhelp.com/app/home/p_data/
https://store.office.cn/addinstemplate
https://www.ups.com/be/fr/Home.page
https://wus2-000.pagecontentsync.
https://www.ups.com/ni/es/Home.page
https://www.ups.com/nt/en/Home.page
https://www.ups.com/ao/en/Home.page
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
https://www.ups.com/mp/en/Home.page
https://www.odwebp.svc.ms
https://www.ups.com/bq/en/Home.page
https://www.ups.com/pg/en/Home.page
https://www.ups.com/am/en/Home.page
https://graph.windows.net
https://www.ups.com/jm/en/Home.page
https://www.ups.com/ye/en/Home.page
https://www.ups.com/lu/fr/Home.page
https://www.ups.com/pe/en/Home.page
https://www.ups.com/mr/en/Home.page

Dropped files

Name File Type Hashes Detection
C:\Users\Public\biwa\wd.exe
HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\841975.xls.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 14:03:39 2020, mtime=Fri Oct 16 09:37:47 2020, atime=Fri Oct 16 09:37:47 2020, length=91136, window=hide
#
C:\Users\user\Desktop\~$841975.xls
data
#
Click to see the 7 hidden entries
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F2988993-9E26-4B2F-86EF-6D4CF913D263
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3C6ADBA1.png
PNG image data, 1214 x 767, 8-bit colormap, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\global[1].htm
HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
#
C:\Users\user\AppData\Local\Temp\02810000
data
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Thu Jun 27 16:19:49 2019, mtime=Fri Oct 16 09:37:47 2020, atime=Fri Oct 16 09:37:47 2020, length=8192, window=hide
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
#
C:\Users\user\Desktop\D2810000
Applesoft BASIC program data, first line number 16
#