Windows Analysis Report SRLTX-1266305223.xlsb

Overview

General Information

Sample Name:	SRLTX-1266305223.xlsb
Analysis ID:	532384
MD5:	9a33b86fa2ee2372023d418129238b25
SHA1:	d94101917d187df6bd710f2abf288cf9f2ee86c9
SHA256:	141a23ce14ba6702fdba9d074fe66eab9f9084be7030033b0258656942a3c660
Tags:	xlsx
Infos:
Most interesting Screenshot:

Detection

Hidden Macro 4.0

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Multi AV Scanner detection for submitted file

Found malicious Excel 4.0 Macro

Found Excel 4.0 Macro with suspicious formulas

Sigma detected: Microsoft Office Product Spawning Windows Shell

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Found protected and hidden Excel 4.0 Macro sheet

Found a hidden Excel 4.0 Macro sheet

Potential document exploit detected (unknown TCP traffic)

May sleep (evasive loops) to hinder dynamic analysis

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected potential crypto function

Contains functionality for execution timing, often used to detect debuggers

Classification

Signatures

AV Detection:

Multi AV Scanner detection for submitted file

Source: SRLTX-1266305223.xlsb	Virustotal: Detection: 14%			Perma Link
Source: SRLTX-1266305223.xlsb	ReversingLabs: Detection: 33%

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 80.71.157.224:80

Source: excel.exe

Memory has grown: Private usage: 4MB later: 31MB

Networking:

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 80.71.157.224:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 101.99.95.15:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 185.104.195.81:80

Source: unknown	TCP traffic detected without corresponding DNS query: 80.71.157.224
Source: unknown	TCP traffic detected without corresponding DNS query: 80.71.157.224
Source: unknown	TCP traffic detected without corresponding DNS query: 80.71.157.224
Source: unknown	TCP traffic detected without corresponding DNS query: 80.71.157.224
Source: unknown	TCP traffic detected without corresponding DNS query: 80.71.157.224
Source: unknown	TCP traffic detected without corresponding DNS query: 80.71.157.224
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.95.15
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.95.15
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.95.15
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.95.15
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.95.15
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.95.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.104.195.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.104.195.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.104.195.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.104.195.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.104.195.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.104.195.81

Source: EXCEL.EXE, 00000000.00000002.935374287.00000000058E3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.667354007.00000000058EC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.540318968.00000000058EE000.00000004.00000001.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.comQ equals www.linkedin.com (Linkedin)
Source: EXCEL.EXE, 00000000.00000002.934677009.0000000004F90000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.726677892.0000000004980000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.707387043.0000000004850000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.689944169.0000000004810000.00000002.00020000.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: EXCEL.EXE, 00000000.00000002.935374287.00000000058E3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.667354007.00000000058EC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.540318968.00000000058EE000.00000004.00000001.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)

Source: EXCEL.EXE, 00000000.00000002.935283630.0000000005755000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.540300873.000000000590F000.00000004.00000001.sdmp	String found in binary or memory: http://101.99.95.15/650918116841.dat
Source: EXCEL.EXE, 00000000.00000003.540300873.000000000590F000.00000004.00000001.sdmp	String found in binary or memory: http://101.99.95.15/650918116841.dat0
Source: EXCEL.EXE, 00000000.00000002.935283630.0000000005755000.00000004.00000001.sdmp	String found in binary or memory: http://101.99.95.15/650918116841.datu
Source: EXCEL.EXE, 00000000.00000002.935890014.000000000590F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.667337972.000000000590F000.00000004.00000001.sdmp	String found in binary or memory: http://185.104.195.81/650918116841.dat
Source: EXCEL.EXE, 00000000.00000002.935890014.000000000590F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.667337972.000000000590F000.00000004.00000001.sdmp	String found in binary or memory: http://185.104.195.81/650918116841.datl
Source: EXCEL.EXE, 00000000.00000002.935283630.0000000005755000.00000004.00000001.sdmp	String found in binary or memory: http://80.71.157.224/650918116841.dat
Source: EXCEL.EXE, 00000000.00000002.935283630.0000000005755000.00000004.00000001.sdmp	String found in binary or memory: http://80.71.157.224/650918116841.dat$
Source: EXCEL.EXE, 00000000.00000002.934677009.0000000004F90000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.726677892.0000000004980000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.707387043.0000000004850000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.689944169.0000000004810000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com
Source: EXCEL.EXE, 00000000.00000002.934677009.0000000004F90000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.726677892.0000000004980000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.707387043.0000000004850000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.689944169.0000000004810000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com/
Source: EXCEL.EXE, 00000000.00000002.934880728.0000000005177000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.726897219.0000000004B67000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.707603613.0000000004A37000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.690168731.00000000049F7000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: EXCEL.EXE, 00000000.00000002.934880728.0000000005177000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.726897219.0000000004B67000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.707603613.0000000004A37000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.690168731.00000000049F7000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: regsvr32.exe, 00000005.00000002.726239843.0000000003AB0000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.706943138.0000000003B30000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.689549592.0000000003A30000.00000002.00020000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: regsvr32.exe, 00000005.00000002.725755552.0000000001D40000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.706494735.0000000001DE0000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.688892478.0000000001C70000.00000002.00020000.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: EXCEL.EXE, 00000000.00000002.934880728.0000000005177000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.726897219.0000000004B67000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.707603613.0000000004A37000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.690168731.00000000049F7000.00000002.00020000.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: EXCEL.EXE, 00000000.00000002.934880728.0000000005177000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.726897219.0000000004B67000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.707603613.0000000004A37000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.690168731.00000000049F7000.00000002.00020000.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: regsvr32.exe, 00000005.00000002.726239843.0000000003AB0000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.706943138.0000000003B30000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.689549592.0000000003A30000.00000002.00020000.sdmp	String found in binary or memory: http://www.%s.comPA
Source: EXCEL.EXE, 00000000.00000002.934677009.0000000004F90000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.726677892.0000000004980000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.707387043.0000000004850000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.689944169.0000000004810000.00000002.00020000.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: EXCEL.EXE, 00000000.00000002.934880728.0000000005177000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.726897219.0000000004B67000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.707603613.0000000004A37000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.690168731.00000000049F7000.00000002.00020000.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: EXCEL.EXE, 00000000.00000002.934677009.0000000004F90000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.726677892.0000000004980000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.707387043.0000000004850000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.689944169.0000000004810000.00000002.00020000.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: regsvr32.exe, 00000008.00000002.689944169.0000000004810000.00000002.00020000.sdmp	String found in binary or memory: http://www.windows.com/pctv.

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E5B98A58.jpg

Jump to behavior

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable editing" in the yellow bar above. example of notification ( 0 ~EcmwARNNG Thisfileoriginate
Source: Screenshot number: 4	Screenshot OCR: Enable Content" to perform Microsoft Excel Decryption Core to start the decryption of the document.
Source: Screenshot number: 4	Screenshot OCR: Enable Macros ) Why I can not open this document? - You are using iOS or Android device. Please us
Source: Screenshot number: 8	Screenshot OCR: Enable editing" in the yellow bar above. example of notification ( 0 ~EcmwARNNG Thisfileoriginate
Source: Screenshot number: 8	Screenshot OCR: Enable Content" to perform Microsoft Excel Decryption Core to start the decryption of the document.
Source: Screenshot number: 8	Screenshot OCR: Enable Macros ) Why I can not open this document? - You are using iOS or Android device. Please us

Found malicious Excel 4.0 Macro

Source: SRLTX-1266305223.xlsb

Macro extractor: Sheet: Tiposa contains: urlmon

Found Excel 4.0 Macro with suspicious formulas

Source: SRLTX-1266305223.xlsb

Initial sample: EXEC

Found protected and hidden Excel 4.0 Macro sheet

Source: SRLTX-1266305223.xlsb	Initial sample: Sheet name: Tiposa1
Source: SRLTX-1266305223.xlsb	Initial sample: Sheet name: Tiposa

Found a hidden Excel 4.0 Macro sheet

Source: SRLTX-1266305223.xlsb	Macro extractor: Sheet name: Tiposa1
Source: SRLTX-1266305223.xlsb	Macro extractor: Sheet name: Tiposa

Detected potential crypto function

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02F966F3	0_2_02F966F3
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02F966E8	0_2_02F966E8
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02F96753	0_2_02F96753
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02F96340	0_2_02F96340
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02F96743	0_2_02F96743

Source: SRLTX-1266305223.xlsb	Virustotal: Detection: 14%
Source: SRLTX-1266305223.xlsb	ReversingLabs: Detection: 33%

Source: C:\Windows\System32\regsvr32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 C:\ProgramData\Volet1.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 C:\ProgramData\Volet2.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 C:\ProgramData\Volet3.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 C:\ProgramData\Volet1.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 C:\ProgramData\Volet2.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 C:\ProgramData\Volet3.ocx	Jump to behavior

Source: EXCEL.EXE, 00000000.00000002.934677009.0000000004F90000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.726677892.0000000004980000.00000002.00020000.sdmp, regsvr32.exe, 00000007.00000002.707387043.0000000004850000.00000002.00020000.sdmp, regsvr32.exe, 00000008.00000002.689944169.0000000004810000.00000002.00020000.sdmp

Binary or memory string: .VBPud<_

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$SRLTX-1266305223.xlsb

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRC725.tmp

Jump to behavior

Source: classification engine

Classification label: mal84.expl.evad.winXLSB@7/5@0/3

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SRLTX-1266305223.xlsb	Initial sample: OLE zip file path = xl/media/image1.jpg
Source: SRLTX-1266305223.xlsb	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: 11750000.0.dr	Initial sample: OLE zip file path = xl/media/image1.jpg
Source: 11750000.0.dr	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\regsvr32.exe TID: 2056	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 888	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2696	Thread sleep time: -60000s >= -30000s	Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Code function: 0_2_02F966F3 rdtsc

0_2_02F966F3

Anti Debugging:

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Code function: 0_2_02F966F3 rdtsc

0_2_02F966F3

Source: EXCEL.EXE, 00000000.00000002.933106758.0000000000790000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: EXCEL.EXE, 00000000.00000002.933106758.0000000000790000.00000002.00020000.sdmp	Binary or memory string: !Progman
Source: EXCEL.EXE, 00000000.00000002.933106758.0000000000790000.00000002.00020000.sdmp	Binary or memory string: Program Manager<

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.104.195.81	unknown	Iran (ISLAMIC Republic Of)	202391	AFRARASAIR	false
101.99.95.15	unknown	Malaysia	45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	false
80.71.157.224	unknown	unknown	197301	PARKNET-ASDK	false

ID:	532384
Product:	CloudBasic
Start time:	07:37:14
Start date:	02.12.2021
Sample:	SRLTX-1266305223.xlsb
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	9a33b86fa2ee2372023d418129238b25
SHA1:	d94101917d187df6bd710f2abf288cf9f2ee86c9
SHA256:	141a23ce14ba6702fdba9d074fe66eab9f9084be7030033b0258656942a3c660
Filetype:	Microsoft Excel Office Binary workbook document (40504/1) 83.51%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E5B98A58.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1098x988, frames 3	4F100E2CEFED046B44EC799015B454EF	5149E5D1B5212C77B3548914E9B47D67B4BEA574	D30B441AB0E88A1487F29A80D63E2A4865A3F5DF7854FB8359B354397F807E2C
C:\Users\user\Desktop\11750000	Microsoft Excel 2007+	C827763DB12655106D4C2A35D67B6142	E9BC340F643F9D8372D27F7D53848CD5AA6B92F1	A1B5A84C413D1C25DBEF36E0E0EF2D2837D7D94398B985279BE932A31B6B186B
C:\Users\user\Desktop\11750000:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\Desktop\SRLTX-1266305223.xlsb (copy)	Microsoft Excel 2007+	C827763DB12655106D4C2A35D67B6142	E9BC340F643F9D8372D27F7D53848CD5AA6B92F1	A1B5A84C413D1C25DBEF36E0E0EF2D2837D7D94398B985279BE932A31B6B186B
C:\Users\user\Desktop\~$SRLTX-1266305223.xlsb	data	797869BB881CFBCDAC2064F92B26E46F	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185

Windows Analysis Report SRLTX-1266305223.xlsb

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs