top title background image
flash

Order List.xlsx

Status: finished
Submission Time: 2020-11-20 11:59:56 +01:00
Malicious
Trojan
Exploiter
Evader
FormBook

Comments

Tags

  • VelvetSweatshop
  • xlsx

Details

  • Analysis ID:
    321137
  • API (Web) ID:
    544075
  • Analysis Started:
    2020-11-20 12:04:08 +01:00
  • Analysis Finished:
    2020-11-20 12:14:17 +01:00
  • MD5:
    b86395637ffd2f1a85acfe7a2f43f8d6
  • SHA1:
    f378cb75a5b73b995c78bb0a779488059cc44c44
  • SHA256:
    36a4989dba737cef8d0067e2b7a06ad29e5ec9ea96bdb7d3e41cf08af37c8553
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

Third Party Analysis Engines

malicious
Score: 15/48
malicious

IPs

IP Country Detection
137.59.52.234
India
67.227.214.78
United States
198.23.212.188
United States
Click to see the 4 hidden entries
34.102.136.180
United States
104.24.122.89
United States
185.119.173.57
United Kingdom
198.54.117.216
United States

Domains

Name IP Detection
teelinkz.com
34.102.136.180
alloutdoorspeaker.com
137.59.52.234
crimson.school
34.102.136.180
Click to see the 12 hidden entries
www.pornfilm3d.com
104.24.122.89
californiapropiedades.com
67.227.214.78
www.the-trinity-project.com
185.119.173.57
www.natcandy.com
0.0.0.0
www.nanox.ltd
0.0.0.0
www.alloutdoorspeaker.com
0.0.0.0
www.teelinkz.com
0.0.0.0
www.heritagediscovery.info
0.0.0.0
www.crimson.school
0.0.0.0
www.californiapropiedades.com
0.0.0.0
parkingpage.namecheap.com
198.54.117.216
www.tnicholson.design
65.254.250.119

URLs

Name Detection
http://www.natcandy.com/o56q/?sFNp=jpX0Lfi0J&mL0=txyYMtCM76zgLKXk1qYYn+5SCVWoTymC4Fy9/8gvc5WTXTsch9hYV+sG2t1iNylweztP4w==
http://www.teelinkz.com/o56q/?sFNp=jpX0Lfi0J&mL0=kNK7qyUu0ssORWb2BQjm/XfEOCgL/rCBvS1q+B2CMQED5QxzM1Z/xIceLMT4/tikHS2Lng==
http://www.pornfilm3d.com/o56q/?sFNp=jpX0Lfi0J&mL0=B+oguf8ZoLV3WGdfJzBRzAgDmcX+4hJ8FJ+I0/mWlmQn56ZLUkNDQwA/Y9AdAB6o/3r8rA==
Click to see the 97 hidden entries
http://198.23.212.188/reg/vbc.exe
http://www.alloutdoorspeaker.com/o56q/?mL0=FKXiaoKe3bemDRIUugzxxbPTRBaZLZeqFtxjN0B1OdNP6J3XvAf3eeDn7VbbZMxcUak0EA==&sFNp=jpX0Lfi0J
http://search.nifty.com/
http://www.ozu.es/favicon.ico
http://search.sify.com/
http://openimage.interpark.com/interpark.ico
http://search.yahoo.co.jp/favicon.ico
http://search.ebay.com/
http://www.gmarket.co.kr/
http://uk.search.yahoo.com/
http://searchresults.news.com.au/
http://www.google.si/
http://www.google.cz/
http://www.soso.com/
http://espanol.search.yahoo.com/
http://images.joins.com/ui_c/fvc_joins.ico
http://www.rambler.ru/favicon.ico
http://list.taobao.com/browse/search_visual.htm?n=15&q=
http://google.pchome.com.tw/
http://browse.guardian.co.uk/favicon.ico
http://www.pchome.com.tw/favicon.ico
http://busca.buscape.com.br/favicon.ico
http://sads.myspace.com/
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
http://www.amazon.de/
http://www.ceneo.pl/
http://www.iask.com/
http://p.zhongsou.com/favicon.ico
http://search.centrum.cz/favicon.ico
http://www.myspace.com/favicon.ico
http://search.espn.go.com/
http://investor.msn.com/
http://search.ipop.co.kr/favicon.ico
http://search.interpark.com/
http://suche.freenet.de/favicon.ico
http://search.seznam.cz/favicon.ico
http://cgi.search.biglobe.ne.jp/
http://www.tesco.com/
http://www.univision.com/
http://search.orange.co.uk/favicon.ico
http://buscador.terra.es/
http://www.target.com/
http://search.yahoo.co.jp
http://auto.search.msn.com/response.asp?MT=
http://cnweb.search.live.com/results.aspx?q=
http://busca.orange.es/
http://www.asharqalawsat.com/
http://www.google.it/
http://search.ebay.it/
http://www.sogou.com/favicon.ico
http://search.rediff.com/
http://busca.igbusca.com.br//app/static/images/favicon.ico
http://msk.afisha.ru/
http://%s.com
http://image.excite.co.jp/jp/favicon/lep.ico
http://search.ebay.in/
http://img.shopzilla.com/shopzilla/shopzilla.ico
http://in.search.yahoo.com/
http://rover.ebay.com
http://fr.search.yahoo.com/
http://asp.usatoday.com/
http://www.windows.com/pctv.
http://www.iis.fhg.de/audioPA
http://search.yahoo.com/favicon.ico
http://buscar.ya.com/
http://www3.fnac.com/favicon.ico
http://www.dailymail.co.uk/
http://www.nifty.com/favicon.ico
http://www.rambler.ru/
http://www.mtv.com/
http://search.ebay.de/
http://www.merlin.com.pl/favicon.ico
http://www.mercadolivre.com.br/
http://www.clarin.com/favicon.ico
http://search.chol.com/favicon.ico
http://suche.t-online.de/
http://search.centrum.cz/
http://www.cjmall.com/
http://www.priceminister.com/favicon.ico
http://www.ask.com/
http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
http://busca.igbusca.com.br/
http://search.about.com/
http://kr.search.yahoo.com/
http://buscar.ozu.es/
http://search.auction.co.kr/
http://search.msn.co.jp/results.aspx?q=
http://search.naver.com/favicon.ico
http://search.daum.net/
http://www.abril.com.br/favicon.ico
http://cgi.search.biglobe.ne.jp/favicon.ico
http://search.hanafos.com/favicon.ico
http://www.google.ru/
http://search.naver.com/
http://it.search.dada.net/favicon.ico
http://www.etmall.com.tw/favicon.ico
http://www.ya.com/favicon.ico

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\Desktop\~$Order List.xlsx
data
#
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
Click to see the 3 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\636483E5.jpeg
gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\64EDB67F.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A92FDE74.jpeg
gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
#