top title background image
flash

_FM_BUSAN_HOCHIMINH_.xlsx

Status: finished
Submission Time: 2022-02-16 09:06:23 +01:00
Malicious
Exploiter

Comments

Tags

  • VelvetSweatshop
  • xlsx

Details

  • Analysis ID:
    573118
  • API (Web) ID:
    940640
  • Analysis Started:
    2022-02-16 09:10:03 +01:00
  • Analysis Finished:
    2022-02-16 09:23:13 +01:00
  • MD5:
    9d7bf0f2fbb81660c8b91c2a323fde4e
  • SHA1:
    7adf1d60fd08b3accd3a8e58fbdcc674bd1b02ee
  • SHA256:
    d60188bc3e17e3fe9a8353a5eb4b791316968f3c1cea1e4e88138718efec0611
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 96
System: Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
malicious
Score: 56
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run Condition: Potential for more IOCs and behavior

Third Party Analysis Engines

malicious
Score: 23/60
malicious
Score: 15/42

IPs

IP Country Detection
198.46.132.195
United States

URLs

Name Detection
http://198.46.132.195/ProgramFile/.win32.exe
http://crl.thawte.com/ThawteTimestampingCA.crl0
https://www.chiark.greenend.org.uk/~sgtatham/putty/
Click to see the 2 hidden entries
https://www.chiark.greenend.org.uk/~sgtatham/putty/0
http://ocsp.thawte.com0

Dropped files

Name File Type Hashes Detection
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\Desktop\~$_FM_BUSAN_HOCHIMINH_.xlsx
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.win32[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
Click to see the 17 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BC3008FF.png
PNG image data, 413 x 220, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Temp\~DFE7F835AEEEC2A8C9.TMP
data
#
C:\Users\user\AppData\Local\Temp\~DF6D2E29A086E66B49.TMP
data
#
C:\Users\user\AppData\Local\Temp\~DF2D24CE383036F6FE.TMP
data
#
C:\Users\user\AppData\Local\Temp\~DF0E35C54C087F7535.TMP
CDFV2 Encrypted
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ED74FEBB.png
PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D68EB503.png
PNG image data, 139 x 180, 8-bit colormap, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CB03F909.png
PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\92ED0EF4.png
PNG image data, 139 x 180, 8-bit colormap, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8CB27180.png
PNG image data, 458 x 211, 8-bit/color RGB, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\87C9FA8A.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6EA96328.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 160x160, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6157F522.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 160x160, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5FD2FA65.png
PNG image data, 139 x 180, 8-bit colormap, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\56B0538E.png
PNG image data, 139 x 180, 8-bit colormap, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\53C8C381.png
PNG image data, 413 x 220, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\364E3B76.png
PNG image data, 458 x 211, 8-bit/color RGB, non-interlaced
#