top title background image
flash

Compensation-1730406737-09272021.xls

Status: finished
Submission Time: 2021-09-27 16:50:17 +02:00
Malicious
Exploiter
Evader
Hidden Macro 4.0

Comments

Tags

Details

  • Analysis ID:
    491509
  • API (Web) ID:
    859083
  • Analysis Started:
    2021-09-27 16:50:18 +02:00
  • Analysis Finished:
    2021-09-27 17:05:56 +02:00
  • MD5:
    b4b3a2223765ac84c9b1b05dbf7c6503
  • SHA1:
    57bc35cb0c7a9ac6e7fcb5dea5c211fe5eda5fe0
  • SHA256:
    3982ae3e61a6ba86d61bd8f017f6238cc9afeb08b785010d686716e8415b6a36
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

IPs

IP Country Detection
185.183.96.67
Netherlands
190.14.37.178
Panama
185.250.148.213
Russian Federation

URLs

Name Detection
http://www.%s.comPA
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
http://190.14.37.178/44466.7022844907.dat
Click to see the 3 hidden entries
http://185.250.148.213/44466.7022844907.dat
http://185.183.96.67/44466.7022844907.dat
http://servername/isapibackend.dll

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44466.7022844907[1].dat
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44466.7022844907[2].dat
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44466.7022844907[3].dat
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
Click to see the 5 hidden entries
C:\Users\user\Drezd.red
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\Drezd1.red
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\Drezd2.red
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
data
#
C:\Users\user\AppData\Local\Temp\VBE\RefEdit.exd
data
#