analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

oBfsC4t10n2.xls

Full analysis: https://app.any.run/tasks/10b0ddb1-fc5d-4a4e-8ca1-5300eb5ca64f
Verdict: Malicious activity
Analysis date: May 21, 2022, 09:04:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros40
maldoc-42
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: 0xdf, Last Saved By: 0xdf, Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Mar 23 14:19:10 2020, Last Saved Time/Date: Sat Apr 25 19:43:56 2020, Security: 0
MD5:

0C09FBDF98F0A6144A42FDE00FE21504

SHA1:

BB4A594ECF90ED6B9E408C404B08620500FB4C02

SHA256:

1F156F86D45E28DAC74015051546305497ADB86B4E46BB7D9A84CCF5E25A12F4

SSDEEP:

12288:53wXyuDwsryfLlYUFZWyehWg6rj4P8pJNjavyP:5Axr2YUWyXvzD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops known malicious document

      • EXCEL.EXE (PID: 2072)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Checks supported languages

      • EXCEL.EXE (PID: 2072)
    • Reads the computer name

      • EXCEL.EXE (PID: 2072)
    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

HeadingPairs:
  • Worksheets
  • 1
  • Excel 4.0 Macros
  • 1
TitleOfParts:
  • invoice
  • c1zB0vasNo
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
ModifyDate: 2020:04:25 18:43:56
CreateDate: 2020:03:23 14:19:10
Software: Microsoft Excel
LastModifiedBy: 0xdf
Author: 0xdf
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2072"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXEExplorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
Total events
2 540
Read events
2 469
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
1
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
2072EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR96A9.tmp.cvr
MD5:
SHA256:
2072EXCEL.EXEC:\Users\admin\AppData\Local\Temp\oBfsC4t10n2.xlsdocument
MD5:662F01A0C82631D05B2BB7F1D5ADA9AD
SHA256:904F6B819499F2D10580544ECBDE7E65A3A7BF4B1203AA296D1F8270A988C77E
2072EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DF309B46B7ECEFC414.TMPatn
MD5:CF02D2A71BD1962DC00BFFF9B2948C72
SHA256:B5BA876684F71F5E1E39856808ABFC3DC0DC06E72B5AB022E836F6232A2F982F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info