File name: | 0d19036452353ce98e267e3fa689e39efcea6fe9cfe1d8938fa7ab216b8c1568.xls |
Full analysis: | https://app.any.run/tasks/070de6e0-6782-4cec-91a2-2c36e6c78f7a |
Verdict: | Malicious activity |
Analysis date: | September 30, 2020, 07:44:49 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Sep 23 10:43:26 2020, Security: 0 |
MD5: | 11A34C3A6E554BA7FDA7069A1C2CD6F5 |
SHA1: | D5F49560A3BD391DEF3CC247E4D38A98C716EC06 |
SHA256: | 0D19036452353CE98E267E3FA689E39EFCEA6FE9CFE1D8938FA7AB216B8C1568 |
SSDEEP: | 3072:z/7uDphYHceXVhca+fMHLtyeGxcl8/dgS6YsFGDJEFB6cv4p5RwY5xEN41:77uDphYHceXVhca+fMHLty/xcl8/dgxi |
.xls | | | Microsoft Excel sheet (78.9) |
---|
Author: | - |
---|---|
LastModifiedBy: | - |
Software: | Microsoft Excel |
CreateDate: | 2006:09:16 00:00:00 |
ModifyDate: | 2020:09:23 09:43:26 |
Security: | None |
CodePage: | Windows Cyrillic |
AppVersion: | 14 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: |
|
HeadingPairs: |
|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
4072 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
3724 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1668 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
4072 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRBCC9.tmp.cvr | — | |
MD5:— | SHA256:— | |||
4072 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF87454533E8E013A6.TMP | — | |
MD5:— | SHA256:— | |||
4072 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\577D3000 | — | |
MD5:— | SHA256:— | |||
4072 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFD60AF8D6850C8563.TMP | — | |
MD5:— | SHA256:— | |||
4072 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\PRH81KME.txt | text | |
MD5:298E68836D8E1FE2C2EB10A1D9757B55 | SHA256:6BF9E99AD904DFF82AAAE01686F15AD6F248A9D571A980C112A87A9F9DF7C129 | |||
4072 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\77421A14.tmp | document | |
MD5:8CFCBA43D566CBEA3E50F166B588390A | SHA256:5E64CF30C15A3279918CF2EAC67EAE5C9B16E8CE9DF3EBB21DFB5E217BB30A03 | |||
4072 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\0d19036452353ce98e267e3fa689e39efcea6fe9cfe1d8938fa7ab216b8c1568.xls | document | |
MD5:8CFCBA43D566CBEA3E50F166B588390A | SHA256:5E64CF30C15A3279918CF2EAC67EAE5C9B16E8CE9DF3EBB21DFB5E217BB30A03 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4072 | EXCEL.EXE | GET | 404 | 104.31.77.17:80 | http://gammasolutionsltd.com/nplwhk/999999.png | US | html | 186 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4072 | EXCEL.EXE | 104.31.77.17:80 | gammasolutionsltd.com | Cloudflare Inc | US | shared |
4072 | EXCEL.EXE | 172.67.220.32:80 | gammasolutionsltd.com | — | US | unknown |
Domain | IP | Reputation |
---|---|---|
gammasolutionsltd.com |
| malicious |