ul9kpUwYel.xls

Options

Comments

Tags

• SilentBuilder
• xls

SilentBuilder xls

Add new tag

Available tags:

No tags available...

• Engines
• IOCs

Full Report	Management Report	Engine	Info	Verdict	Score	Reports
			System: Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)		100/100
					26/62
					9/36
					21/29

IPs

IP	Country	Detection
104.18.58.219	United States
104.22.1.232	United States
195.201.225.248	Germany
Click to see the 2 hidden entries
192.185.194.191	United States
37.46.150.139	Moldova Republic of

Domains

Name	IP	Detection
cutt.ly	104.22.1.232
trashbininspector.fun	104.18.58.219
chebo.discountmonumentcenter.com	192.185.194.191
Click to see the 1 hidden entries
telete.in	195.201.225.248

URLs

Name	Detection
http://chebo.discountmonumentcenter.com/vantuz_2021.exe
http://www.piriform.com/ccleaner
http://37.46.150.139/bat/scriptxls_bcb01d52-349f-4210-b1fc-2540a097ee09_fteenetx_wdexclusion.bat
Click to see the 3 hidden entries
http://www.%s.comPA
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv

Dropped files

Name	File Type	Hashes	Detection
C:\Users\user\AppData\Roaming\cr.exe	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed	#
C:\Users\user\Documents\pd.bat	ASCII text, with very long lines, with CRLF line terminators	#
C:\Users\user\AppData\LocalLow\1xVPfvJcrg	SQLite 3.x database, last written using SQLite version 3032001	#
Click to see the 19 hidden entries
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, 58936 bytes, 1 file	#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	#
C:\Users\user\AppData\LocalLow\frAQBc8Wsa	SQLite 3.x database, last written using SQLite version 3032001	#
C:\Users\user\AppData\LocalLow\sqlite3.dll	PE32 executable (DLL) (console) Intel 80386, for MS Windows	#
C:\Users\user\AppData\Local\Temp\741F0000	data	#
C:\Users\user\AppData\Local\Temp\Cab6613.tmp	Microsoft Cabinet archive data, 58936 bytes, 1 file	#
C:\Users\user\AppData\Local\Temp\Tar6614.tmp	data	#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Fri Jan 8 16:05:56 2021, atime=Fri Jan 8 16:05:56 2021, length=8192, window=hide	#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\ul9kpUwYel.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:24 2020, mtime=Fri Jan 8 16:05:56 2021, atime=Fri Jan 8 16:05:56 2021, length=289280, window=hide	#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1LYCPT5GDMC5WV088G26.temp	data	#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\20519T597D0EZEFAD1MF.temp	data	#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PNBQABH49BUBWNJMEEIM.temp	data	#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T70ZP6LTUP685KT127GQ.temp	data	#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W2MFNCCZKET1DP3F8CLA.temp	data	#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XLLWWEN87DPEWAHB9XA5.temp	data	#
C:\Users\user\Desktop\251F0000	Applesoft BASIC program data, first line number 16	#