Windows Analysis Report SCAN_7295943480515097.xlsm

ID:	532474
Product:	CloudBasic
Start time:	10:15:31
Start date:	02.12.2021
Sample:	SCAN_7295943480515097.xlsm
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	1ab11dce30326f39f6186f9aa05d5777
SHA1:	397dd88ca9d78a16ab549a8d22a711ddbea80c05
SHA256:	8f8e07b2eaca8af62e86cebd2372f1b85d420091801ec472796387a44a98bbcd
Filetype:	Excel Microsoft Office Open XML Format document with Macro (51004/1) 51.52%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\GSCXBEVV.htm	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators	8390656A9CE7D214386AE81EA0B89D32	B2B0D4E1F626E16601C3F58EC95109A06312AEF7	AC7541E64DD6B4FAF9E12E8DB314AFB68F2E35B8ADBE0EA87C2B5B2D879240A0
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2FADF20A.png	PNG image data, 1714 x 241, 8-bit colormap, non-interlaced	4FE798EE522800691796BC9446918C90	1E01CDE49D0B1B5E2F0DFBAD568DC2ECFBEDEAD3	EC0BC049D3D30C29567806EB2D555589CD2E1B6B30E9145F77B73A32EC1C1087
C:\Users\user\AppData\Local\Temp\CBD7.tmp	Composite Document File V2 Document, Cannot read section info	72F5C05B7EA8DD6059BF59F50B22DF33	D5AF52E129E15E3A34772806F6C5FBF132E7408E	1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
C:\Users\user\AppData\Local\Temp\~DFDF944FEFD380A8E6.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\Desktop\~$SCAN_7295943480515097.xlsm	data	797869BB881CFBCDAC2064F92B26E46F	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
C:\Users\user\besta.ocx	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators	8390656A9CE7D214386AE81EA0B89D32	B2B0D4E1F626E16601C3F58EC95109A06312AEF7	AC7541E64DD6B4FAF9E12E8DB314AFB68F2E35B8ADBE0EA87C2B5B2D879240A0

AV Detection:

Multi AV Scanner detection for submitted file

Source: SCAN_7295943480515097.xlsm

Virustotal: Detection: 21%

Perma Link

Antivirus detection for URL or domain

Source: http://standoutglobal.com/2/MWpqeVgZ/Softwa	Avira URL Cloud: Label: malware
Source: http://standoutglobal.com/2/MWpqeVgZ/1-48FD	Avira URL Cloud: Label: malware

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 107.180.46.229:443 -> 192.168.2.22:49169 version: TLS 1.2

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\SysWOW64\rundll32.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 162.240.9.126:80

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: standoutglobal.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49169 -> 107.180.46.229:443

Networking:

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vendes.marketingConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /transmigrant/Wplzr/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vendes.marketingConnection: Keep-Alive

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443

Found strings which match to known social media urls

Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: src="https://www.facebook.com/tr?id=408176514230511&ev=PageView&noscript=1" equals www.facebook.com (Facebook)
Source: EXCEL.EXE, 00000000.00000003.537240809.0000000005B21000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.739956925.0000000005B21000.00000004.00000001.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: EXCEL.EXE, 00000000.00000002.737179895.00000000050F0000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.477889247.0000000001F10000.00000002.00020000.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: EXCEL.EXE, 00000000.00000003.537240809.0000000005B21000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.739956925.0000000005B21000.00000004.00000001.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

URLs found in memory or binary data

Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537253356.0000000005B39000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.739967235.0000000005B39000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: EXCEL.EXE, 00000000.00000002.737179895.00000000050F0000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.477889247.0000000001F10000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com
Source: EXCEL.EXE, 00000000.00000002.737179895.00000000050F0000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.477889247.0000000001F10000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com/
Source: EXCEL.EXE, 00000000.00000002.737396730.00000000052D7000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.478045523.00000000020F7000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: EXCEL.EXE, 00000000.00000002.737396730.00000000052D7000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.478045523.00000000020F7000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537253356.0000000005B39000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.739967235.0000000005B39000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: EXCEL.EXE, 00000000.00000002.740262687.0000000007996000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.740096336.0000000006E36000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.740202968.00000000072A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.740233220.00000000078E6000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.open
Source: EXCEL.EXE, 00000000.00000002.740202968.00000000072A6000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.openformatrg/drawml/2006/spreadsheetD
Source: EXCEL.EXE, 00000000.00000002.740096336.0000000006E36000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.openformatrg/package/2006/content-t
Source: EXCEL.EXE, 00000000.00000002.740262687.0000000007996000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.740233220.00000000078E6000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.openformatrg/package/2006/r
Source: EXCEL.EXE, 00000000.00000002.737396730.00000000052D7000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.478045523.00000000020F7000.00000002.00020000.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: EXCEL.EXE, 00000000.00000002.737971130.00000000056CB000.00000004.00000001.sdmp	String found in binary or memory: http://standoutglobal.c
Source: EXCEL.EXE, 00000000.00000002.737971130.00000000056CB000.00000004.00000001.sdmp	String found in binary or memory: http://standoutglobal.co
Source: EXCEL.EXE, 00000000.00000002.737971130.00000000056CB000.00000004.00000001.sdmp	String found in binary or memory: http://standoutglobal.com%http://standoutglobal.com/2/MWpqeVgZ/
Source: EXCEL.EXE, 00000000.00000002.737128548.0000000004ED6000.00000004.00000001.sdmp	String found in binary or memory: http://standoutglobal.com/2/MWpqeVgZ/1-48FD
Source: EXCEL.EXE, 00000000.00000002.737128548.0000000004ED6000.00000004.00000001.sdmp	String found in binary or memory: http://standoutglobal.com/2/MWpqeVgZ/Softwa
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: http://vendes.marketing/
Source: EXCEL.EXE, 00000000.00000002.737128548.0000000004ED6000.00000004.00000001.sdmp	String found in binary or memory: http://vendes.marketing/transmigrant/Wplzr/
Source: EXCEL.EXE, 00000000.00000002.737396730.00000000052D7000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.478045523.00000000020F7000.00000002.00020000.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: EXCEL.EXE, 00000000.00000002.737179895.00000000050F0000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.477889247.0000000001F10000.00000002.00020000.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: EXCEL.EXE, 00000000.00000002.737396730.00000000052D7000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.478045523.00000000020F7000.00000002.00020000.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: EXCEL.EXE, 00000000.00000002.737179895.00000000050F0000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.477889247.0000000001F10000.00000002.00020000.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000004.00000002.477889247.0000000001F10000.00000002.00020000.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: EXCEL.EXE, 00000000.00000002.735831519.000000000050F000.00000004.00000020.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://api.w.org/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://connect.facebook.net/es_LA/sdk/xfbml.customerchat.js
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Josefin
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Roboto:ital
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic
Source: EXCEL.EXE, 00000000.00000003.537059494.0000000005BB8000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://s.w.org/images/core/emoji/13.1.0/svg/1f609.svg
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://schema.org
Source: EXCEL.EXE, 00000000.00000002.739976079.0000000005B56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537253356.0000000005B39000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.739967235.0000000005B39000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/
Source: EXCEL.EXE, 00000000.00000003.537069612.0000000005B5F000.00000004.00000001.sdmp	String found in binary or memory: https://vendes.marketing/C:
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital-en-cdmx/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital-en-guadalajara/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital-en-monterrey/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/auditorias-y-optimizacion-de-camp
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/consultoria-en-marketing-basado-e
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/consultoria-para-adsense/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/consultoria-para-youtube/
Source: EXCEL.EXE, 00000000.00000003.537059494.0000000005BB8000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/digital-partner-incubadora-de-neg
Source: EXCEL.EXE, 00000000.00000003.537059494.0000000005BB8000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/marketing-para-el-sector-salud/
Source: EXCEL.EXE, 00000000.00000003.537059494.0000000005BB8000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/marketing-para-inmobiliarias-cons
Source: EXCEL.EXE, 00000000.00000003.537059494.0000000005BB8000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/marketing-para-startups/
Source: EXCEL.EXE, 00000000.00000003.537059494.0000000005BB8000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/transformacion-de-empresas/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/amazon-seo/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/conversion-rate-optimizati
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/crm/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/emailing/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/google-merchant-center/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/pagos-online/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tienda-online-con-magento/
Source: EXCEL.EXE, 00000000.00000003.537059494.0000000005BB8000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tienda-online-con-shopify/
Source: EXCEL.EXE, 00000000.00000003.537059494.0000000005BB8000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tienda-online-con-wordpres
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tiendas-en-facebook-e-inst
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/amazon-seo/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/conversion-rate-optimization/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/crm/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/emailing/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/google-merchant-center/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/pagos-online/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tienda-online-con-magento/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tienda-online-con-shopify/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tienda-online-con-wordpress-woocomme
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tiendas-en-facebook-e-instagram/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/branding/
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/diseno-editorial/
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/diseno-grafico/
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/diseno-web-ux/
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/fotografia-y-edicion/
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/produccion-audiovisual/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/automatizacion-de-
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-apli
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-mega
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-pagi
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-tien
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/creacion-de-con
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/estrategias-en-
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/facebook-ads/
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/google-ads-adwo
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/inbound-marketi
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/inteligencia-de
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/publicidad-digi
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/seo-posicionami
Source: EXCEL.EXE, 00000000.00000003.537059494.0000000005BB8000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/blog/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/comments/feed/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/feed/
Source: EXCEL.EXE, 00000000.00000003.537240809.0000000005B21000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.739956925.0000000005B21000.00000004.00000001.sdmp	String found in binary or memory: https://vendes.marketing/nY
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.0.2
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.0.2
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/lib/lottie/lottie.min.js?ver=5.6.6
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.mi
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?ver
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.4.8
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.4.8
Source: EXCEL.EXE, 00000000.00000003.537272193.0000000005BB1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537148185.0000000005B9C000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.4.8
Source: EXCEL.EXE, 00000000.00000003.537272193.0000000005BB1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537148185.0000000005B9C000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.4.8
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.4.8
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3
Source: EXCEL.EXE, 00000000.00000003.537272193.0000000005BB1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537148185.0000000005B9C000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.8.1
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.eot?5.10.0);src
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.svg?5.10.0#eico
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.ttf?5.10.0)
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.10.0)
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=4.
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/font-awesome.min.c
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.cs
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/v4-shims.min.css?v
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver
Source: EXCEL.EXE, 00000000.00000003.537272193.0000000005BB1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537148185.0000000005B9C000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.
Source: EXCEL.EXE, 00000000.00000003.537272193.0000000005BB1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537148185.0000000005B9C000.00000004.00000001.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/happy-elementor-addons/assets/fonts/style.min.css?ver=3.
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/plugins/happy-elementor-addons/assets/js/happy-addons.min.js?ver
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/css/ie.css?ver=1.4
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/css/print.css?ver=1.4
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/js/polyfills.js?ver=1.4
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/js/primary-navigation.js?ver=1.4
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/js/responsive-embeds.js?ver=1.4
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/AE.svg
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/anuncios-300x270.png
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/anuncios.png
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/apple_android.svg
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/elementor.svg
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/figma.svg
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/framer.svg
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-facebook.png
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-google-adwords.png
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-instagram.png
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-youtube.png
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/microsoft.svg
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/visual-Studio.svg
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/webflow.svg
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-1024x348.png
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-1536x522.png
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-1568x533.png
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-2048x696.png
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-300x102.png
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-768x261.png
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/global.css?ver=1637592552
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-1522.css?ver=1638212153
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-2017.css?ver=1638212282
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-2157.css?ver=1638212282
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-5.css?ver=1637592550
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/caso-exito1.png
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/comentario1.jpg
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/comentario5-m.jpg
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/comentario6.jpg
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-includes/css/dist/block-library/style.min.css?ver=5.8.2
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-includes/js/wp-embed.min.js?ver=5.8.2
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-includes/wlwmanifest.xml
Source: EXCEL.EXE, 00000000.00000002.735831519.000000000050F000.00000004.00000020.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-json/
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fvendes.marketing%2F
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fvendes.marketing%2F&format=
Source: EXCEL.EXE, 00000000.00000002.735831519.000000000050F000.00000004.00000020.sdmp, besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/wp-json/wp/v2/pages/1522
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://vendes.marketing/xmlrpc.php?rsd
Source: besta.ocx.0.dr, GSCXBEVV.htm.0.dr	String found in binary or memory: https://www.thinkwithgoogle.com/intl/es-419/futuro-del-marketing/transformacion-digital/tiendas-omni
Source: GSCXBEVV.htm.0.dr	String found in binary or memory: https://www.thinkwithgoogle.com/intl/es-419/insights/tendencias-de-consumo/6-certezas-sobre-el-nuevo

Downloads files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2FADF20A.png

Jump to behavior

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: standoutglobal.com

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vendes.marketingConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /transmigrant/Wplzr/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vendes.marketingConnection: Keep-Alive

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 107.180.46.229:443 -> 192.168.2.22:49169 version: TLS 1.2

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled editing. please click "Enable Content
Source: Screenshot number: 4	Screenshot OCR: protected documents. 3 4 CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled edi
Source: Screenshot number: 4	Screenshot OCR: Enable Content" button 6 7 8 9 10 11 12 13 14 15 RunDLL |~| 16 17 18 The'e was a proble
Source: Screenshot number: 8	Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled editing. please click "Enable Content
Source: Screenshot number: 8	Screenshot OCR: protected documents. 3 4 CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled edi
Source: Screenshot number: 8	Screenshot OCR: Enable Content" button 6 7 8 9 :: 12 13 14 15 16 17 18 q ^ Ly 20 21 22 23 24 2
Source: Document image extraction number: 0	Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, please click "Enable Content"
Source: Document image extraction number: 0	Screenshot OCR: protected documents. CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, p
Source: Document image extraction number: 0	Screenshot OCR: Enable Content" button
Source: Document image extraction number: 1	Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, please click "Enable Content"
Source: Document image extraction number: 1	Screenshot OCR: protected documents. CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, p
Source: Document image extraction number: 1	Screenshot OCR: Enable Content" button

Found a hidden Excel 4.0 Macro sheet

Source: SCAN_7295943480515097.xlsm	Macro extractor: Sheet name: Buk2
Source: SCAN_7295943480515097.xlsm	Macro extractor: Sheet name: Buk5
Source: SCAN_7295943480515097.xlsm	Macro extractor: Sheet name: Buk1
Source: SCAN_7295943480515097.xlsm	Macro extractor: Sheet name: Buk7
Source: SCAN_7295943480515097.xlsm	Macro extractor: Sheet name: EFEWF
Source: SCAN_7295943480515097.xlsm	Macro extractor: Sheet name: Buk3
Source: SCAN_7295943480515097.xlsm	Macro extractor: Sheet name: Buk4
Source: SCAN_7295943480515097.xlsm	Macro extractor: Sheet name: Buk6

Detected potential crypto function

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02E966E8		0_2_02E966E8
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02E966F3		0_2_02E966F3
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02E96340		0_2_02E96340
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02E96743		0_2_02E96743
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02E96753		0_2_02E96753
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02E9CF01		0_2_02E9CF01

Excel documents contains an embedded macro which executes code when the document is opened

Source: workbook.xml

Binary string: \Desktop\Fil\1d\Cir\" xmlns:x15ac="http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac"/></mc:Choice></mc:AlternateContent><xr:revisionPtr revIDLastSave="0" documentId="13_ncr:1_{8197EE46-A436-4D64-BA91-0FA619A1F240}" xr6:coauthVersionLast="45" xr6:coauthVersionMax="45" xr10:uidLastSave="{00000000-0000-0000-0000-000000000000}"/><bookViews><workbookView xWindow="-120" yWindow="-120" windowWidth="20730" windowHeight="11160" xr2:uid="{00000000-000D-0000-FFFF-FFFF00000000}"/></bookViews><sheets><sheet name="Sheet" sheetId="1" r:id="rId1"/><sheet name="Ss1" sheetId="2" state="hidden" r:id="rId2"/><sheet name="Ss1br2" sheetId="3" state="hidden" r:id="rId3"/><sheet name="Ssbr3" sheetId="4" state="hidden" r:id="rId4"/><sheet name="EFEWF" sheetId="5" state="hidden" r:id="rId5"/><sheet name="Buk1" sheetId="6" state="hidden" r:id="rId6"/><sheet name="Buk2" sheetId="7" state="hidden" r:id="rId7"/><sheet name="Buk3" sheetId="8" state="hidden" r:id="rId8"/><sheet name="Buk4" sheetId="9" state="hidden" r:id="rId9"/><sheet name="Buk5" sheetId="10" state="hidden" r:id="rId10"/><sheet name="Buk6" sheetId="11" state="hidden" r:id="rId11"/><sheet name="Buk7" sheetId="12" state="hidden" r:id="rId12"/></sheets><definedNames><definedName name="LKLW">EFEWF!$D$3</definedName><definedName name="SASA">EFEWF!$D$17</definedName><definedName name="SASA1">EFEWF!$D$19</definedName><definedName name="SASA2">EFEWF!$D$21</definedName><definedName name="_xlnm.Auto_Open">EFEWF!$D$1</definedName></definedNames><calcPr calcId="191029"/><extLst><ext uri="{B58B0392-4F1F-4190-BB64-5DF3571DCE5F}" xmlns:xcalcf="http://schemas.microsoft.com/office/spreadsheetml/2018/calcfeatures"><xcalcf:calcFeatures><xcalcf:feature name="microsoft.com:RD"/><xcalcf:feature name="microsoft.com:FV"/></xcalcf:calcFeatures></ext></extLst></workbook>

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76F90000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E90000 page execute and read and write			Jump to behavior

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: CBD7.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Sample is known by Antivirus

Source: SCAN_7295943480515097.xlsm

Virustotal: Detection: 21%

Reads software policies

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Runs a DLL by calling functions

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.4280415509

Spawns processes

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.4280415509
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.4280415509			Jump to behavior

Binary contains paths to development resources

Source: EXCEL.EXE, 00000000.00000002.737179895.00000000050F0000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.477889247.0000000001F10000.00000002.00020000.sdmp

Binary or memory string: .VBPud<_

Creates files inside the user directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$SCAN_7295943480515097.xlsm

Jump to behavior

Creates temporary files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRE58D.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal76.expl.winXLSM@3/6@2/2

Reads ini files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Document is a ZIP file with path names indicative of goodware

Source: SCAN_7295943480515097.xlsm	Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: SCAN_7295943480515097.xlsm	Initial sample: OLE zip file path = xl/media/image1.png
Source: SCAN_7295943480515097.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: SCAN_7295943480515097.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: SCAN_7295943480515097.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: SCAN_7295943480515097.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: SCAN_7295943480515097.xlsm	Initial sample: OLE zip file path = xl/calcChain.xml

Checks if Microsoft Office is installed

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Document has a 'vbamacros' value indicative of goodware

Source: CBD7.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Yara detected Xls With Macro 4.0

Source: Yara match

File source: app.xml, type: SAMPLE

May try to detect the Windows Explorer process (often used for injection)

Source: EXCEL.EXE, 00000000.00000002.735884786.0000000000890000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: EXCEL.EXE, 00000000.00000002.735884786.0000000000890000.00000002.00020000.sdmp	Binary or memory string: !Progman
Source: EXCEL.EXE, 00000000.00000002.735884786.0000000000890000.00000002.00020000.sdmp	Binary or memory string: Program Manager<