Windows Analysis Report CU-6431 report.xlsm

Overview

General Information

Sample Name: CU-6431 report.xlsm
Analysis ID: 532531
MD5: 0630d6c04e8365531eff7998a7fc40c6
SHA1: e4c59420e2024e4f5f5a14e0cd366023d9d0e636
SHA256: bd2212ffe0d388a61a3041f146a70b242fa69eace0c7a5f5fe991126a679eec4
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Multi AV Scanner detection for submitted file
Antivirus detection for URL or domain
Sigma detected: Microsoft Office Product Spawning Windows Shell
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Found a hidden Excel 4.0 Macro sheet
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication
Yara detected Xls With Macro 4.0
Detected potential crypto function
JA3 SSL client fingerprint seen in connection with other malware
Excel documents contains an embedded macro which executes code when the document is opened
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for execution timing, often used to detect debuggers
Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: CU-6431 report.xlsm Virustotal: Detection: 19% Perma Link
Source: CU-6431 report.xlsm ReversingLabs: Detection: 20%
Antivirus detection for URL or domain
Source: http://standoutglobal.com/2/MWpqeVgZ/ Avira URL Cloud: Label: malware
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 162.240.9.126:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.180.46.229:443 -> 192.168.2.22:49170 version: TLS 1.2

Software Vulnerabilities:

barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA Jump to behavior
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 162.240.9.126:80
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: standoutglobal.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 162.240.9.126:443

Networking:

barindex
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vendes.marketingConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /transmigrant/Wplzr/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vendes.marketingConnection: Keep-Alive
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: src="https://www.facebook.com/tr?id=408176514230511&ev=PageView&noscript=1" equals www.facebook.com (Facebook)
Source: EXCEL.EXE, 00000000.00000002.685947300.0000000005AB4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486338801.0000000005AB4000.00000004.00000001.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.comc equals www.linkedin.com (Linkedin)
Source: EXCEL.EXE, 00000000.00000002.684741985.0000000005200000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.427088618.0000000000740000.00000002.00020000.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: EXCEL.EXE, 00000000.00000002.685947300.0000000005AB4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486338801.0000000005AB4000.00000004.00000001.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 02 Dec 2021 10:29:19 GMTServer: ApacheVary: Accept-Encoding,CookieExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://standoutglobal.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: EXCEL.EXE, 00000000.00000002.685910358.0000000005A9A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.685972647.0000000005ACA000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486326814.0000000005A9A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486345149.0000000005ACA000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: EXCEL.EXE, 00000000.00000002.684741985.0000000005200000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.427088618.0000000000740000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com
Source: EXCEL.EXE, 00000000.00000002.684741985.0000000005200000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.427088618.0000000000740000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com/
Source: EXCEL.EXE, 00000000.00000002.685143788.00000000053E7000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.427258216.0000000000927000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: EXCEL.EXE, 00000000.00000002.685143788.00000000053E7000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.427258216.0000000000927000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.685972647.0000000005ACA000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486345149.0000000005ACA000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: EXCEL.EXE, 00000000.00000002.685910358.0000000005A9A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486326814.0000000005A9A000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: EXCEL.EXE, 00000000.00000002.685910358.0000000005A9A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486326814.0000000005A9A000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: EXCEL.EXE, 00000000.00000002.686466621.00000000070E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.686603731.0000000007256000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.686544793.0000000007116000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.686646122.0000000007386000.00000004.00000001.sdmp String found in binary or memory: http://schemas.open
Source: EXCEL.EXE, 00000000.00000002.686544793.0000000007116000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openformatrg/drawml/2006/spreadsheetD
Source: EXCEL.EXE, 00000000.00000002.686466621.00000000070E6000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openformatrg/package/2006/content-t
Source: EXCEL.EXE, 00000000.00000002.686603731.0000000007256000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.686646122.0000000007386000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openformatrg/package/2006/r
Source: EXCEL.EXE, 00000000.00000002.685143788.00000000053E7000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.427258216.0000000000927000.00000002.00020000.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: EXCEL.EXE, 00000000.00000002.685731683.0000000005874000.00000004.00000001.sdmp String found in binary or memory: http://standoutglobal.c
Source: EXCEL.EXE, 00000000.00000002.685731683.0000000005874000.00000004.00000001.sdmp String found in binary or memory: http://standoutglobal.co
Source: EXCEL.EXE, 00000000.00000002.685731683.0000000005874000.00000004.00000001.sdmp String found in binary or memory: http://standoutglobal.com%http://standoutglobal.com/2/MWpqeVgZ/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: http://vendes.marketing/
Source: EXCEL.EXE, 00000000.00000002.685143788.00000000053E7000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.427258216.0000000000927000.00000002.00020000.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: EXCEL.EXE, 00000000.00000002.684741985.0000000005200000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.427088618.0000000000740000.00000002.00020000.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: EXCEL.EXE, 00000000.00000002.685143788.00000000053E7000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.427258216.0000000000927000.00000002.00020000.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: EXCEL.EXE, 00000000.00000002.684741985.0000000005200000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.427088618.0000000000740000.00000002.00020000.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000003.00000002.427088618.0000000000740000.00000002.00020000.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: EXCEL.EXE, 00000000.00000002.683097145.0000000000562000.00000004.00000020.sdmp, EXCEL.EXE, 00000000.00000003.486310134.0000000005A61000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.685844909.0000000005A28000.00000004.00000001.sdmp, besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://api.w.org/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: EXCEL.EXE, 00000000.00000003.486370741.0000000005B20000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486301501.0000000005B40000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486383823.0000000005B38000.00000004.00000001.sdmp, besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://connect.facebook.net/es_LA/sdk/xfbml.customerchat.js
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://fonts.googleapis.com/css2?family=Josefin
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://fonts.googleapis.com/css2?family=Roboto:ital
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic
Source: EXCEL.EXE, 00000000.00000003.486301501.0000000005B40000.00000004.00000001.sdmp, besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://s.w.org/images/core/emoji/13.1.0/svg/1f609.svg
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://schema.org
Source: EXCEL.EXE, 00000000.00000002.685910358.0000000005A9A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.685972647.0000000005ACA000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486326814.0000000005A9A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486345149.0000000005ACA000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: EXCEL.EXE, 00000000.00000002.685910358.0000000005A9A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486326814.0000000005A9A000.00000004.00000001.sdmp String found in binary or memory: https://standoutglobal.com/
Source: EXCEL.EXE, 00000000.00000003.486310134.0000000005A61000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.685844909.0000000005A28000.00000004.00000001.sdmp String found in binary or memory: https://standoutglobal.com/2/MWpqeVgZ/
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: https://vendes.marketing/8
Source: EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: https://vendes.marketing/C:
Source: EXCEL.EXE, 00000000.00000003.486301501.0000000005B40000.00000004.00000001.sdmp, besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital-en-cdmx/
Source: EXCEL.EXE, 00000000.00000003.486301501.0000000005B40000.00000004.00000001.sdmp, besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital-en-guadalajara/
Source: EXCEL.EXE, 00000000.00000003.486301501.0000000005B40000.00000004.00000001.sdmp, besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital-en-monterrey/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/auditorias-y-optimizacion-de-camp
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/consultoria-en-marketing-basado-e
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/consultoria-para-adsense/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/consultoria-para-youtube/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/digital-partner-incubadora-de-neg
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/marketing-para-el-sector-salud/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/marketing-para-inmobiliarias-cons
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/marketing-para-startups/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/transformacion-de-empresas/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/amazon-seo/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/conversion-rate-optimizati
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/crm/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/emailing/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/google-merchant-center/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/pagos-online/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tienda-online-con-magento/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tienda-online-con-shopify/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tienda-online-con-wordpres
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tiendas-en-facebook-e-inst
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/amazon-seo/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/conversion-rate-optimization/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/crm/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/emailing/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/google-merchant-center/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/pagos-online/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tienda-online-con-magento/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tienda-online-con-shopify/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tienda-online-con-wordpress-woocomme
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tiendas-en-facebook-e-instagram/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/branding/
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/diseno-editorial/
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/diseno-grafico/
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/diseno-web-ux/
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/fotografia-y-edicion/
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/produccion-audiovisual/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/automatizacion-de-
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-apli
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-mega
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-pagi
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-tien
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/creacion-de-con
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/estrategias-en-
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/facebook-ads/
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/google-ads-adwo
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/inbound-marketi
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/inteligencia-de
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/publicidad-digi
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/seo-posicionami
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/blog/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/comments/feed/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/feed/
Source: EXCEL.EXE, 00000000.00000002.685983285.0000000005AD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.486348634.0000000005AD9000.00000004.00000001.sdmp String found in binary or memory: https://vendes.marketing/g
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.0.2
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.0.2
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/lib/lottie/lottie.min.js?ver=5.6.6
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.mi
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?ver
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.4.8
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.4.8
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.4.8
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.4.8
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.4.8
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.8.1
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.eot?5.10.0);src
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.svg?5.10.0#eico
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.ttf?5.10.0)
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.10.0)
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=4.
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/font-awesome.min.c
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.cs
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/v4-shims.min.css?v
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/happy-elementor-addons/assets/fonts/style.min.css?ver=3.
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/happy-elementor-addons/assets/js/happy-addons.min.js?ver
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/css/ie.css?ver=1.4
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/css/print.css?ver=1.4
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/js/polyfills.js?ver=1.4
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/js/primary-navigation.js?ver=1.4
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/js/responsive-embeds.js?ver=1.4
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/AE.svg
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/anuncios-300x270.png
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/anuncios.png
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/apple_android.svg
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/elementor.svg
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/figma.svg
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/framer.svg
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-facebook.png
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-google-adwords.png
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-instagram.png
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-youtube.png
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/microsoft.svg
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/visual-Studio.svg
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/webflow.svg
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-1024x348.png
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-1536x522.png
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-1568x533.png
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-2048x696.png
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-300x102.png
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-768x261.png
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/global.css?ver=1637592552
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-1522.css?ver=1638212153
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-2017.css?ver=1638212282
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-2157.css?ver=1638212282
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-5.css?ver=1637592550
Source: EXCEL.EXE, 00000000.00000003.486301501.0000000005B40000.00000004.00000001.sdmp, besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/caso-exito1.png
Source: EXCEL.EXE, 00000000.00000003.486301501.0000000005B40000.00000004.00000001.sdmp, besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/comentario1.jpg
Source: EXCEL.EXE, 00000000.00000003.486301501.0000000005B40000.00000004.00000001.sdmp, besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/comentario5-m.jpg
Source: EXCEL.EXE, 00000000.00000003.486301501.0000000005B40000.00000004.00000001.sdmp, besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/comentario6.jpg
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/css/dist/block-library/style.min.css?ver=5.8.2
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/wp-embed.min.js?ver=5.8.2
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/wlwmanifest.xml
Source: EXCEL.EXE, 00000000.00000003.486310134.0000000005A61000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.685844909.0000000005A28000.00000004.00000001.sdmp, besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-json/
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fvendes.marketing%2F
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fvendes.marketing%2F&#038;format=
Source: EXCEL.EXE, 00000000.00000002.683097145.0000000000562000.00000004.00000020.sdmp, EXCEL.EXE, 00000000.00000003.486310134.0000000005A61000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.685844909.0000000005A28000.00000004.00000001.sdmp, besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-json/wp/v2/pages/1522
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://vendes.marketing/xmlrpc.php?rsd
Source: besta.ocx.0.dr, U7NJK7LJ.htm.0.dr String found in binary or memory: https://www.thinkwithgoogle.com/intl/es-419/futuro-del-marketing/transformacion-digital/tiendas-omni
Source: U7NJK7LJ.htm.0.dr String found in binary or memory: https://www.thinkwithgoogle.com/intl/es-419/insights/tendencias-de-consumo/6-certezas-sobre-el-nuevo
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\17493318.png Jump to behavior
Source: unknown DNS traffic detected: queries for: standoutglobal.com
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vendes.marketingConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /transmigrant/Wplzr/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vendes.marketingConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 162.240.9.126:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.180.46.229:443 -> 192.168.2.22:49170 version: TLS 1.2

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled editing. please click "Enable Content
Source: Screenshot number: 4 Screenshot OCR: protected documents. 3 4 CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled edi
Source: Screenshot number: 4 Screenshot OCR: Enable Content" button 6 7 8 9 10 11 12 13 14 15 16 17 18 ^
Source: Screenshot number: 8 Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled editing. please click "Enable Content
Source: Screenshot number: 8 Screenshot OCR: protected documents. 3 4 CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled edi
Source: Screenshot number: 8 Screenshot OCR: Enable Content" button 6 7 8 9 10 11 12 13 14 15 16 17 18 ^
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, please click "Enable Content"
Source: Document image extraction number: 0 Screenshot OCR: protected documents. CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, p
Source: Document image extraction number: 0 Screenshot OCR: Enable Content" button
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, please click "Enable Content"
Source: Document image extraction number: 1 Screenshot OCR: protected documents. CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, p
Source: Document image extraction number: 1 Screenshot OCR: Enable Content" button
Found a hidden Excel 4.0 Macro sheet
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk2
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk5
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk1
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk7
Source: CU-6431 report.xlsm Macro extractor: Sheet name: EFEWF
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk3
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk4
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk6
Detected potential crypto function
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Code function: 0_2_020B6743 0_2_020B6743
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Code function: 0_2_020B6340 0_2_020B6340
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Code function: 0_2_020B6753 0_2_020B6753
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Code function: 0_2_020B66E8 0_2_020B66E8
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Code function: 0_2_020B66F3 0_2_020B66F3
Excel documents contains an embedded macro which executes code when the document is opened
Source: workbook.xml Binary string: \Desktop\Fil\1d\Cir\" xmlns:x15ac="http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac"/></mc:Choice></mc:AlternateContent><xr:revisionPtr revIDLastSave="0" documentId="13_ncr:1_{8197EE46-A436-4D64-BA91-0FA619A1F240}" xr6:coauthVersionLast="45" xr6:coauthVersionMax="45" xr10:uidLastSave="{00000000-0000-0000-0000-000000000000}"/><bookViews><workbookView xWindow="-120" yWindow="-120" windowWidth="20730" windowHeight="11160" xr2:uid="{00000000-000D-0000-FFFF-FFFF00000000}"/></bookViews><sheets><sheet name="Sheet" sheetId="1" r:id="rId1"/><sheet name="Ss1" sheetId="2" state="hidden" r:id="rId2"/><sheet name="Ss1br2" sheetId="3" state="hidden" r:id="rId3"/><sheet name="Ssbr3" sheetId="4" state="hidden" r:id="rId4"/><sheet name="EFEWF" sheetId="5" state="hidden" r:id="rId5"/><sheet name="Buk1" sheetId="6" state="hidden" r:id="rId6"/><sheet name="Buk2" sheetId="7" state="hidden" r:id="rId7"/><sheet name="Buk3" sheetId="8" state="hidden" r:id="rId8"/><sheet name="Buk4" sheetId="9" state="hidden" r:id="rId9"/><sheet name="Buk5" sheetId="10" state="hidden" r:id="rId10"/><sheet name="Buk6" sheetId="11" state="hidden" r:id="rId11"/><sheet name="Buk7" sheetId="12" state="hidden" r:id="rId12"/></sheets><definedNames><definedName name="LKLW">EFEWF!$D$3</definedName><definedName name="SASA">EFEWF!$D$17</definedName><definedName name="SASA1">EFEWF!$D$19</definedName><definedName name="SASA2">EFEWF!$D$21</definedName><definedName name="_xlnm.Auto_Open">EFEWF!$D$1</definedName></definedNames><calcPr calcId="191029"/><extLst><ext uri="{B58B0392-4F1F-4190-BB64-5DF3571DCE5F}" xmlns:xcalcf="http://schemas.microsoft.com/office/spreadsheetml/2018/calcfeatures"><xcalcf:calcFeatures><xcalcf:feature name="microsoft.com:RD"/><xcalcf:feature name="microsoft.com:FV"/></xcalcf:calcFeatures></ext></extLst></workbook>
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: 709E.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: CU-6431 report.xlsm Virustotal: Detection: 19%
Source: CU-6431 report.xlsm ReversingLabs: Detection: 20%
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.4786822917
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.4786822917
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.4786822917 Jump to behavior
Source: EXCEL.EXE, 00000000.00000002.684741985.0000000005200000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.427088618.0000000000740000.00000002.00020000.sdmp Binary or memory string: .VBPud<_
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$CU-6431 report.xlsm Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRD4EA.tmp Jump to behavior
Source: classification engine Classification label: mal76.expl.winXLSM@3/6@2/2
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/media/image1.png
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/calcChain.xml
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: 709E.tmp.0.dr Initial sample: OLE indicators vbamacros = False
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Code function: 0_2_020B6743 rdtsc 0_2_020B6743

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Code function: 0_2_020B6743 rdtsc 0_2_020B6743

HIPS / PFW / Operating System Protection Evasion:

barindex
Yara detected Xls With Macro 4.0
Source: Yara match File source: app.xml, type: SAMPLE
Source: EXCEL.EXE, 00000000.00000002.683143713.00000000008E0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: EXCEL.EXE, 00000000.00000002.683143713.00000000008E0000.00000002.00020000.sdmp Binary or memory string: !Progman
Source: EXCEL.EXE, 00000000.00000002.683143713.00000000008E0000.00000002.00020000.sdmp Binary or memory string: Program Manager<
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532531 Sample: CU-6431 report.xlsm Startdate: 02/12/2021 Architecture: WINDOWS Score: 76 19 Antivirus detection for URL or domain 2->19 21 Multi AV Scanner detection for submitted file 2->21 23 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->23 25 2 other signatures 2->25 6 EXCEL.EXE 57 25 2->6         started        process3 dnsIp4 15 standoutglobal.com 162.240.9.126, 443, 49167, 49168 UNIFIEDLAYER-AS-1US United States 6->15 17 vendes.marketing 107.180.46.229, 443, 49169, 49170 AS-26496-GO-DADDY-COM-LLCUS United States 6->17 13 C:\Users\user\Desktop\~$CU-6431 report.xlsm, data 6->13 dropped 27 Document exploit detected (UrlDownloadToFile) 6->27 11 rundll32.exe 6->11         started        file5 signatures6 process7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.240.9.126
 standoutglobal.com United States
46606 UNIFIEDLAYER-AS-1US false
107.180.46.229
 vendes.marketing United States
26496 AS-26496-GO-DADDY-COM-LLCUS false

Contacted Domains

Name IP Active
standoutglobal.com 162.240.9.126 true
vendes.marketing 107.180.46.229 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://standoutglobal.com/2/MWpqeVgZ/ true
  • Avira URL Cloud: malware
 unknown
https://vendes.marketing/ false
  • Avira URL Cloud: safe
 unknown
http://vendes.marketing/transmigrant/Wplzr/ false
  • Avira URL Cloud: safe
 unknown
https://standoutglobal.com/2/MWpqeVgZ/ false
  • Avira URL Cloud: safe
 unknown