File name:

P.O.03019.xls

Full analysis: https://app.any.run/tasks/d7b7a6ac-c88f-4046-9a0c-174942145271
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 01, 2023, 07:24:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
opendir
exploit
cve-2017-11882
loader
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 00:00:00 2006, Last Saved Time/Date: Thu Mar 30 16:45:32 2023, Security: 0
MD5:

C9ABCCCFF82B1C656F933105FF2EF1FE

SHA1:

A13315BCD6303D712443DBC2BA28FA0A76C59011

SHA256:

2186F319B48330C907D13F58F4A2AA5D987E2E2551CC677886DF8D242B6D2E9A

SSDEEP:

24576:rLKZ2WQmmav30xRu9VHu9V+u9VI+MXUyu9Vz+MXUMKYPBShTPYw:rLKZrQmmQ30DuPuGuQ+MXbur+MXHBZS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2384)

    • Application was dropped or rewritten from another process

      • vbc.exe (PID: 2972)

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 2384)

  • SUSPICIOUS

    • Reads the Internet Settings

      • EQNEDT32.EXE (PID: 2384)
      • vbc.exe (PID: 2972)

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 2384)

    • Process requests binary or script from the Internet

      • EQNEDT32.EXE (PID: 2384)

    • Connects to the server without a host name

      • EQNEDT32.EXE (PID: 2384)

  • INFO

    • Creates files or folders in the user directory

      • EQNEDT32.EXE (PID: 2384)

    • The process checks LSA protection

      • EQNEDT32.EXE (PID: 2384)
      • vbc.exe (PID: 2972)

    • Checks supported languages

      • EQNEDT32.EXE (PID: 2384)
      • vbc.exe (PID: 2972)

    • Reads the computer name

      • EQNEDT32.EXE (PID: 2384)
      • vbc.exe (PID: 2972)

    • Reads the machine GUID from the registry

      • EQNEDT32.EXE (PID: 2384)

    • Reads Environment values

      • vbc.exe (PID: 2972)

    • Checks proxy server information

      • EQNEDT32.EXE (PID: 2384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (31.2)
.xls | Microsoft Excel sheet (alternate) (25.5)

EXIF

FlashPix

CompObjUserType: Microsoft Office Excel 2003 Worksheet
CompObjUserTypeLen: 38
HeadingPairs:
  • Worksheets
  • 3
TitleOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 12
CodePage: Windows Latin 1 (Western European)
Security: None
ModifyDate: 2023:03:30 16:45:32
CreateDate: 2006:09:16 00:00:00
Software: Microsoft Excel
LastModifiedBy: -
Author: -
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start excel.exe no specs eqnedt32.exe vbc.exe

Process information

PID
CMD
Path
Indicators
Parent process
412"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.4756.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
2384"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
2972"C:\Users\Public\vbc.exe" C:\Users\Public\vbc.exe
EQNEDT32.EXE
User:
admin
Company:
TODO: <Company name>
Integrity Level:
MEDIUM
Description:
TODO: <File description>
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\public\vbc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
3 718
Read events
3 620
Write events
84
Delete events
14

Modification events

(PID) Process:(412) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(412) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(412) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(412) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(412) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(412) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(412) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(412) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(412) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(412) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
4
Suspicious files
0
Text files
0
Unknown types
14

Dropped files

PID
Process
Filename
Type
412EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRFCB5.tmp.cvr —
MD5:—
SHA256:—
412EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\858C2C86.emfemf
MD5:—
SHA256:—
412EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FAF1A6CF.emfemf
MD5:—
SHA256:—
412EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1D6F4610.emfemf
MD5:—
SHA256:—
2384EQNEDT32.EXEC:\Users\Public\vbc.exeexecutable
MD5:—
SHA256:—
2384EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\vbc[1].exeexecutable
MD5:—
SHA256:—
412EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\15D6118B.emfemf
MD5:35E141964E2698FC12D087516D116C9A
SHA256:6A3A2ADDC5D6B554EED64B7C24B699E09BCF019E4F42AB14EC6D40C7CB749538
412EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A882EF32.emfemf
MD5:4D59A7E93170340B5EC4009F7FA3AD31
SHA256:83473215E5C2160333AA92EA7F9B1276D8ED7DD66AFC472DC92C88055D189D7D
412EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\97DAE8B5.emfemf
MD5:0FFCA2E0D06FD9393E46F20F4AE6B53E
SHA256:FA91A49FBA91AF8F9F6487B69D5D3265DFAAA123563A0558B79C0F72792C41C3
412EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\50F2F284.emfemf
MD5:A093C09997099539B4CA7D8903F3227D
SHA256:49F2800A0C860D89167CCCB5F3E87960D8F71881DC47521238AA0C6F5A546951
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
76
TCP/UDP connections
151
DNS requests
1
Threats
126

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2384
EQNEDT32.EXE
GET
200
23.95.122.239:80
http://23.95.122.239/65/vbc.exe
US
executable
315 Kb
malicious
2972
vbc.exe
GET
301
112.213.89.85:80
http://www.trao.com.vn/wp-includes/images/Cryqoqlhhw.png
VN
html
707 b
suspicious
2972
vbc.exe
GET
301
112.213.89.85:80
http://www.trao.com.vn/wp-includes/images/Cryqoqlhhw.png
VN
html
707 b
suspicious
2972
vbc.exe
GET
301
112.213.89.85:80
http://www.trao.com.vn/wp-includes/images/Cryqoqlhhw.png
VN
html
707 b
suspicious
2972
vbc.exe
GET
301
112.213.89.85:80
http://www.trao.com.vn/wp-includes/images/Cryqoqlhhw.png
VN
html
707 b
suspicious
2972
vbc.exe
GET
301
112.213.89.85:80
http://www.trao.com.vn/wp-includes/images/Cryqoqlhhw.png
VN
html
707 b
suspicious
2972
vbc.exe
GET
301
112.213.89.85:80
http://www.trao.com.vn/wp-includes/images/Cryqoqlhhw.png
VN
html
707 b
suspicious
2972
vbc.exe
GET
301
112.213.89.85:80
http://www.trao.com.vn/wp-includes/images/Cryqoqlhhw.png
VN
html
707 b
suspicious
2972
vbc.exe
GET
301
112.213.89.85:80
http://www.trao.com.vn/wp-includes/images/Cryqoqlhhw.png
VN
html
707 b
suspicious
2972
vbc.exe
GET
301
112.213.89.85:80
http://www.trao.com.vn/wp-includes/images/Cryqoqlhhw.png
VN
html
707 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2384
EQNEDT32.EXE
23.95.122.239:80
—
AS-COLOCROSSING
US
malicious
2972
vbc.exe
112.213.89.85:443
www.trao.com.vn
SUPERDATA
VN
suspicious
2972
vbc.exe
112.213.89.85:80
www.trao.com.vn
SUPERDATA
VN
suspicious
—
—
112.213.89.85:80
www.trao.com.vn
SUPERDATA
VN
suspicious
—
—
112.213.89.85:443
www.trao.com.vn
SUPERDATA
VN
suspicious

DNS requests

Domain
IP
Reputation
www.trao.com.vn
  • 112.213.89.85
suspicious

Threats

PID
Process
Class
Message
2384
EQNEDT32.EXE
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
2384
EQNEDT32.EXE
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
2384
EQNEDT32.EXE
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
2384
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2384
EQNEDT32.EXE
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
2384
EQNEDT32.EXE
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2972
vbc.exe
Unknown Traffic
ET JA3 Hash - [Abuse.ch] Possible Tofsee
2972
vbc.exe
Unknown Traffic
ET JA3 Hash - [Abuse.ch] Possible Tofsee
2972
vbc.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2972
vbc.exe
Unknown Traffic
ET JA3 Hash - [Abuse.ch] Possible Tofsee
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
P.O.03019.xls