analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SKM_C30819111181835.xls

Full analysis: https://app.any.run/tasks/310efd82-c4c3-4cf2-919c-f77749cbd9db
Verdict: Malicious activity
Analysis date: December 02, 2019, 22:43:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
ole-embedded
macros-on-open
ta505
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Title: CiBQd, Subject: N, Author: NYxaYK, Last Saved By: Administrator, Revision Number: 602, Name of Creating Application: Microsoft Excel, Total Editing Time: 1d+04:31:00, Create Time/Date: Fri Aug 30 10:14:50 2019, Last Saved Time/Date: Mon Dec 2 20:35:23 2019, Number of Pages: 2, Number of Words: 3929, Number of Characters: 7608, Security: 0
MD5:

E64732DBBA7C812DE3CFD435B5F1F20B

SHA1:

98F84376FE5E050C7783D1819FAB2E6369503066

SHA256:

04C6CE889C9D7E0B4C7D61ECB51F2FDECF3A37CE9892F7A4B6D5D458C8AB4DAF

SSDEEP:

12288:6EB+Jx9Cjs/39lKf94sGg0SOMwItwmtSp+gW3:tcCjsnKG4wbmtcBE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • EXCEL.EXE (PID: 992)
    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 992)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Creates files in the user directory

      • EXCEL.EXE (PID: 992)
    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

HeadingPairs:
  • Worksheets
  • 1
TitleOfParts: Page2
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
Paragraphs: 36
Lines: 230
Bytes: 12777
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 7608
Words: 3929
Pages: 2
ModifyDate: 2019:12:02 20:35:23
CreateDate: 2019:08:30 09:14:50
TotalEditTime: 1.2 days
Software: Microsoft Excel
RevisionNumber: 602
LastModifiedBy: Administrator
Author: NYxaYK
Subject: N
Title: CiBQd
CompObjUserType: Microsoft Forms 2.0 Form
CompObjUserTypeLen: 25
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
1
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start excel.exe

Process information

PID
CMD
Path
Indicators
Parent process
992"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
Total events
720
Read events
581
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
3
Text files
0
Unknown types
5

Dropped files

PID
Process
Filename
Type
992EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRAF07.tmp.cvr
MD5:
SHA256:
992EXCEL.EXEC:\Users\admin\AppData\Local\Temp\VBB786.tmp
MD5:
SHA256:
992EXCEL.EXEC:\Users\admin\AppData\Local\Temp\VBB785.tmp
MD5:
SHA256:
992EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DF38D5A998F9BE0371.TMP
MD5:
SHA256:
992EXCEL.EXEC:\Users\admin\AppData\Local\Temp\E7B93000
MD5:
SHA256:
992EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DFA7892E16B9DD6CB1.TMP
MD5:
SHA256:
992EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~$vds.xlsx
MD5:
SHA256:
992EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DF87AE35A8A3C37C87.TMP
MD5:
SHA256:
992EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9C60DEF0.emfemf
MD5:E16A806016925395CF510111F1179B15
SHA256:31CF4F12D4D843F5E6E41BEE96D21ED86A3E3DD5833D531E81EFE75B088C33F3
992EXCEL.EXEC:\Users\admin\AppData\Local\Temp\oleObject1.binbinary
MD5:C69E9DD0302D34AF7961E115121F05FD
SHA256:0249680033FAADFD7F027E904911C9E0186F8F589CA96F6799FD1BC1C93CBFC4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
992
EXCEL.EXE
172.104.91.16:443
live-en.com
Linode, LLC
JP
malicious

DNS requests

Domain
IP
Reputation
live-en.com
  • 172.104.91.16
malicious

Threats

No threats detected
No debug info