Register Login

sloganpng

top title background image

Booking Confirmation.xlsx

Status: finished

Submission Time: 2021-06-14 08:35:39 +02:00

Malicious

Trojan

Exploiter

Evader

GuLoader

Comments

Tags

Details

Analysis ID:
433966
API (Web) ID:
801557
Analysis Started:

2021-06-14 08:52:50 +02:00
Analysis Finished:

2021-06-14 08:59:45 +02:00
MD5:
0ff57b2fd3fb489d3cca1e3de4fc98ea
SHA1:
48f428a33c81e6647c399a50a71e5ee03c1c2ef9
SHA256:
36e8b5e6839f88f144b51f690004f0464368d437d099fa74534fe1a6223a6ed2
Technologies:

Engines
IOCs

Joe Sandbox

Engine	Download Report	Detection	Info
	Full Report Management Report IOC Report	malicious Score: 100	System: Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

Third Party Analysis Engines

Open Full Report

malicious

Score: 20/69

malicious

Score: 12/46

malicious

malicious

IPs

IP	Country	Detection
103.155.82.236	unknown

URLs

Name	Detection
http://103.155.82.236/nrsdoc/svchost.exe
https://bara-seck.com/bin_NpuMLUuCfC62.bin, http://farmersschool.ge/bin_NpuMLUuCfC62.bin
http://www.day.com/dam/1.0

Dropped files

Name	File Type	Hashes	Detection
C:\Users\Public\vbc.exe	PE32 executable (GUI) Intel 80386, for MS Windows	#
C:\Users\user\Desktop\~$Booking Confirmation.xlsx	data	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe	PE32 executable (GUI) Intel 80386, for MS Windows	#
Click to see the 14 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BE03F06.png	PNG image data, 1686 x 725, 8-bit/color RGBA, non-interlaced	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F7B97C3D.emf	Windows Enhanced Metafile (EMF) image data version 0x10000	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E4B4CA0B.jpeg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DA8A5653.png	PNG image data, 566 x 429, 8-bit/color RGBA, non-interlaced	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D952E9B2.png	PNG image data, 399 x 605, 8-bit/color RGBA, non-interlaced	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D602AD35.png	PNG image data, 566 x 429, 8-bit/color RGBA, non-interlaced	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C1192904.png	PNG image data, 476 x 244, 8-bit/color RGB, non-interlaced	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A5867438.png	PNG image data, 399 x 605, 8-bit/color RGBA, non-interlaced	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A0F13A2C.emf	Windows Enhanced Metafile (EMF) image data version 0x10000	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9DE09D1A.png	PNG image data, 476 x 244, 8-bit/color RGB, non-interlaced	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\60C1A490.png	PNG image data, 1686 x 725, 8-bit/color RGBA, non-interlaced	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\539A36D9.jpeg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2376BB51.png	PNG image data, 1268 x 540, 8-bit/color RGBA, non-interlaced	#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1B15974F.png	PNG image data, 1268 x 540, 8-bit/color RGBA, non-interlaced	#