=
Joe Sandbox Cloud Basic
Register Login
sloganpng
We are hiring! Windows Kernel Developer (Remote), apply here!
flash

TedarikciSiparisi_83613 .xlsx

Status: finished
Submission Time: 2022-05-14 15:08:10 +02:00
Malicious
Trojan
Exploiter
Evader
FormBook

Comments

Tags

  • VelvetSweatshop
  • xlsx

Details

  • Analysis ID:
    626598
  • API (Web) ID:
    994098
  • Analysis Started:
    2022-05-14 15:12:57 +02:00
  • Analysis Finished:
    2022-05-14 15:20:27 +02:00
  • MD5:
    650bb8e5fe570bde782be21c4e9f421c
  • SHA1:
    fd3ffa031546f1dfa7ed884689ca1e85941fca1e
  • SHA256:
    247838308fb5e12a258def82a63e3a752d1536d1771539d63cebcf283b8154b5
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

malicious
100/100

malicious
17/41

malicious

IPs

IP Country Detection
180.214.238.224
 Viet Nam

URLs

Name Detection
http://180.214.238.224/__cloud_for_file/vbc.exe95C:
http://180.214.238.224/__cloud_for_file/vbc.exeu
http://180.214.238.224/__cloud_for_file/vbc.exe
Click to see the 4 hidden entries
http://180.214.238.224/__cloud_for_file/vbc.exeX
http://180.214.238.224/__cloud_for_file/vbc.exehhC:
www.mentalnayaarifmetika.online/ocgr/
http://180.214.238.224/__cloud_for_file/vbc.exej

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\Desktop\~$TedarikciSiparisi_83613 .xlsx
 data
 #
C:\Users\Public\vbc.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
Click to see the 15 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\13820A74.png
 PNG image data, 413 x 220, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2A09A689.jpeg
 JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 160x160, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2DC1A5DE.emf
 Windows Enhanced Metafile (EMF) image data version 0x10000
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3E390AF6.png
 PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\51ABE6A8.png
 PNG image data, 139 x 180, 8-bit colormap, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\57CFF8ED.png
 PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\71BAD9C.jpeg
 JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 160x160, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\74B1E683.png
 PNG image data, 413 x 220, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A1E3120A.png
 PNG image data, 458 x 211, 8-bit/color RGB, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AD99E047.png
 PNG image data, 139 x 180, 8-bit colormap, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F549927F.png
 PNG image data, 458 x 211, 8-bit/color RGB, non-interlaced
 #
C:\Users\user\AppData\Local\Temp\~DF154F786FDBAE324B.TMP
 data
 #
C:\Users\user\AppData\Local\Temp\~DF299AB401C235ABC6.TMP
 data
 #
C:\Users\user\AppData\Local\Temp\~DFDCEA4DA1BBD5FBBA.TMP
 CDFV2 Encrypted
 #
C:\Users\user\AppData\Local\Temp\~DFE8FF70B607AC6E32.TMP
 data
 #