File name: | 23001a18862b571db68b765c5d19ca9aeb1b51ddb8e20f22edb77927a00821a1.xlsx |
Full analysis: | https://app.any.run/tasks/132821e1-29ca-46eb-8949-607385e42cd9 |
Verdict: | Malicious activity |
Analysis date: | May 30, 2020, 12:27:01 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
File info: | Microsoft Excel 2007+ |
MD5: | 56788845A7BB930E520E223FD08C1500 |
SHA1: | F75ACF89E1F1A0A52CB1321D1816F0E6098BA8A8 |
SHA256: | 23001A18862B571DB68B765C5D19CA9AEB1B51DDB8E20F22EDB77927A00821A1 |
SSDEEP: | 192:YrOCXNnSGjwB+Yn/FzEDBK956vwbAi8HanyGOQs9nCK5+0cSKcUoH8Qz72VT8LvE:+NnSGMBpVE9K98gAgnyVDnCgScvoRswd |
.xlsx | | | Excel Microsoft Office Open XML Format document (61.2) |
---|---|---|
.zip | | | Open Packaging Conventions container (31.5) |
.zip | | | ZIP compressed archive (7.2) |
AppVersion: | 15.03 |
---|---|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
Company: | - |
TitlesOfParts: |
|
HeadingPairs: |
|
ScaleCrop: | No |
DocSecurity: | None |
Application: | Microsoft Excel |
ModifyDate: | 2020:04:27 08:48:15Z |
CreateDate: | 2006:09:16 00:00:00Z |
LastModifiedBy: | - |
Creator: | - |
---|
ZipFileName: | [Content_Types].xml |
---|---|
ZipUncompressedSize: | 1641 |
ZipCompressedSize: | 392 |
ZipCRC: | 0x457f7449 |
ZipModifyDate: | 2020:05:13 04:20:06 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0002 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2800 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
3028 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2800 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRD0DA.tmp.cvr | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3028 | EQNEDT32.EXE | GET | 404 | 208.115.234.234:80 | http://rackbolt.in/2a.exe | US | html | 315 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3028 | EQNEDT32.EXE | 208.115.234.234:80 | rackbolt.in | Limestone Networks, Inc. | US | malicious |
Domain | IP | Reputation |
---|---|---|
rackbolt.in |
| malicious |