flash

Order List.xlsx

Status: finished
Submission Time: 20.11.2020 11:59:56
Malicious
Trojan
Exploiter
Evader
FormBook

Comments

Tags

  • VelvetSweatshop
  • xlsx

Details

  • Analysis ID:
    321137
  • API (Web) ID:
    544075
  • Analysis Started:
    20.11.2020 12:04:08
  • Analysis Finished:
    20.11.2020 12:14:17
  • MD5:
    b86395637ffd2f1a85acfe7a2f43f8d6
  • SHA1:
    f378cb75a5b73b995c78bb0a779488059cc44c44
  • SHA256:
    36a4989dba737cef8d0067e2b7a06ad29e5ec9ea96bdb7d3e41cf08af37c8553
  • Technologies:
Full Report Management Report Engine Info Verdict Score Reports

malicious

System: Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

malicious
100/100

malicious
15/48

malicious

IPs

IP Country Detection
137.59.52.234
India
67.227.214.78
United States
198.23.212.188
United States
Click to see the 4 hidden entries
34.102.136.180
United States
104.24.122.89
United States
185.119.173.57
United Kingdom
198.54.117.216
United States

Domains

Name IP Detection
teelinkz.com
34.102.136.180
alloutdoorspeaker.com
137.59.52.234
crimson.school
34.102.136.180
Click to see the 12 hidden entries
www.pornfilm3d.com
104.24.122.89
californiapropiedades.com
67.227.214.78
www.the-trinity-project.com
185.119.173.57
www.natcandy.com
0.0.0.0
www.nanox.ltd
0.0.0.0
www.alloutdoorspeaker.com
0.0.0.0
www.teelinkz.com
0.0.0.0
www.heritagediscovery.info
0.0.0.0
www.crimson.school
0.0.0.0
www.californiapropiedades.com
0.0.0.0
parkingpage.namecheap.com
198.54.117.216
www.tnicholson.design
65.254.250.119

URLs

Name Detection
http://www.alloutdoorspeaker.com/o56q/?mL0=FKXiaoKe3bemDRIUugzxxbPTRBaZLZeqFtxjN0B1OdNP6J3XvAf3eeDn7VbbZMxcUak0EA==&sFNp=jpX0Lfi0J
http://www.pornfilm3d.com/o56q/?sFNp=jpX0Lfi0J&mL0=B+oguf8ZoLV3WGdfJzBRzAgDmcX+4hJ8FJ+I0/mWlmQn56ZLUkNDQwA/Y9AdAB6o/3r8rA==
http://www.teelinkz.com/o56q/?sFNp=jpX0Lfi0J&mL0=kNK7qyUu0ssORWb2BQjm/XfEOCgL/rCBvS1q+B2CMQED5QxzM1Z/xIceLMT4/tikHS2Lng==
Click to see the 97 hidden entries
http://www.natcandy.com/o56q/?sFNp=jpX0Lfi0J&mL0=txyYMtCM76zgLKXk1qYYn+5SCVWoTymC4Fy9/8gvc5WTXTsch9hYV+sG2t1iNylweztP4w==
http://198.23.212.188/reg/vbc.exe
http://www.ceneo.pl/
http://www.amazon.de/
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
http://sads.myspace.com/
http://busca.buscape.com.br/favicon.ico
http://www.pchome.com.tw/favicon.ico
http://browse.guardian.co.uk/favicon.ico
http://google.pchome.com.tw/
http://list.taobao.com/browse/search_visual.htm?n=15&q=
http://www.rambler.ru/favicon.ico
http://uk.search.yahoo.com/
http://espanol.search.yahoo.com/
http://www.ozu.es/favicon.ico
http://search.sify.com/
http://openimage.interpark.com/interpark.ico
http://search.yahoo.co.jp/favicon.ico
http://search.ebay.com/
http://www.gmarket.co.kr/
http://search.nifty.com/
http://searchresults.news.com.au/
http://www.google.si/
http://www.google.cz/
http://www.soso.com/
http://www.univision.com/
http://search.ebay.it/
http://images.joins.com/ui_c/fvc_joins.ico
http://www.asharqalawsat.com/
http://busca.orange.es/
http://cnweb.search.live.com/results.aspx?q=
http://auto.search.msn.com/response.asp?MT=
http://search.yahoo.co.jp
http://www.target.com/
http://buscador.terra.es/
http://search.orange.co.uk/favicon.ico
http://www.iask.com/
http://www.tesco.com/
http://cgi.search.biglobe.ne.jp/
http://search.seznam.cz/favicon.ico
http://suche.freenet.de/favicon.ico
http://search.interpark.com/
http://search.ipop.co.kr/favicon.ico
http://investor.msn.com/
http://search.espn.go.com/
http://www.myspace.com/favicon.ico
http://search.centrum.cz/favicon.ico
http://p.zhongsou.com/favicon.ico
http://search.chol.com/favicon.ico
http://www.mercadolivre.com.br/
http://www.merlin.com.pl/favicon.ico
http://search.ebay.de/
http://www.mtv.com/
http://www.rambler.ru/
http://www.nifty.com/favicon.ico
http://www.dailymail.co.uk/
http://www3.fnac.com/favicon.ico
http://buscar.ya.com/
http://search.yahoo.com/favicon.ico
http://www.iis.fhg.de/audioPA
http://www.sogou.com/favicon.ico
http://asp.usatoday.com/
http://fr.search.yahoo.com/
http://rover.ebay.com
http://in.search.yahoo.com/
http://img.shopzilla.com/shopzilla/shopzilla.ico
http://search.ebay.in/
http://image.excite.co.jp/jp/favicon/lep.ico
http://%s.com
http://msk.afisha.ru/
http://busca.igbusca.com.br//app/static/images/favicon.ico
http://search.rediff.com/
http://www.windows.com/pctv.
http://www.ya.com/favicon.ico
http://www.etmall.com.tw/favicon.ico
http://it.search.dada.net/favicon.ico
http://search.naver.com/
http://www.google.ru/
http://search.hanafos.com/favicon.ico
http://cgi.search.biglobe.ne.jp/favicon.ico
http://www.abril.com.br/favicon.ico
http://search.daum.net/
http://search.naver.com/favicon.ico
http://search.msn.co.jp/results.aspx?q=
http://www.clarin.com/favicon.ico
http://buscar.ozu.es/
http://kr.search.yahoo.com/
http://search.about.com/
http://busca.igbusca.com.br/
http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
http://www.ask.com/
http://www.priceminister.com/favicon.ico
http://www.cjmall.com/
http://search.centrum.cz/
http://suche.t-online.de/
http://www.google.it/
http://search.auction.co.kr/

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\Desktop\~$Order List.xlsx
data
#
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
Click to see the 3 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\636483E5.jpeg
gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\64EDB67F.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A92FDE74.jpeg
gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
#