top title background image
flash

ORDERCONFIRMATION_00001679918.xlsx

Status: finished
Submission Time: 2021-09-27 20:55:28 +02:00
Malicious
Trojan
Exploiter
Evader
FormBook

Comments

Tags

  • VelvetSweatshop
  • xlsx

Details

  • Analysis ID:
    491746
  • API (Web) ID:
    859308
  • Analysis Started:
    2021-09-27 21:07:28 +02:00
  • Analysis Finished:
    2021-09-27 21:15:02 +02:00
  • MD5:
    9c34f5c5e1a78c24947c3fe5fce601ea
  • SHA1:
    727aa4c09c4c4f40d47ba87fa91921876b79f0f3
  • SHA256:
    ff1168daa5edebf6c75a6f24573e0b1e8153156b47e9c91712f8aa7968d745db
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

Third Party Analysis Engines

malicious
Score: 29/69
malicious
Score: 13/45
malicious

IPs

IP Country Detection
23.94.159.204
United States

URLs

Name Detection
http://23.94.159.204/poc/vbc.exe
http://www.%s.comPA
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Click to see the 3 hidden entries
http://nsis.sf.net/NSIS_Error
http://nsis.sf.net/NSIS_ErrorError
http://www.day.com/dam/1.0

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
#
C:\Users\user\AppData\Local\Temp\nsd99E0.tmp\hmrrcvb.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
#
C:\Users\user\Desktop\~$ORDERCONFIRMATION_00001679918.xlsx
data
#
Click to see the 13 hidden entries
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1692293F.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 509x209, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1C3144A5.png
PNG image data, 484 x 544, 8-bit/color RGB, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\286302FB.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 686x220, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\36E70CB6.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 686x220, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\608AFF49.png
PNG image data, 684 x 477, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\69023234.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\727091C1.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C3F73A62.png
PNG image data, 684 x 477, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CABA28C0.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 509x209, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E1B73268.png
PNG image data, 484 x 544, 8-bit/color RGB, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F76D3143.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
#
C:\Users\user\AppData\Local\Temp\9rvscd0j0b4n1ow
data
#