We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
22 July 2021, 05:05
Analysis environment:
Windows 7 Pro, build 7601, x86
CBJ200620039539.xlsx
MD5:
F7F4EC2A0ADC9CC33CDBC7D548A6BEF9
SHA1:
D460315F92AA3DCA63617431883834ED94C09F45
SHA256:
5F94A66E0CE78D17AFC2DD27FC17B44B3FFC13AC5F42D3AD6A5DCFB36715F3EB
Analysis result
Threat level:
Malicious activity
Tags:
trojan
exploit
cve-2017-11882
Full analysis:
Analysis CBJ200620039539.xlsx (MD5: F7F4EC2A0ADC9CC33CDBC7D548A6BEF9) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Equation Editor starts application (CVE-2017-11882)
EQNEDT32.EXE (PID: 1068)
SUSPICIOUS
Reads the computer name
EQNEDT32.EXE (PID: 1068)
Executed via COM
EQNEDT32.EXE (PID: 1068)
Creates files in the user directory
EQNEDT32.EXE (PID: 1068)
Checks supported languages
EQNEDT32.EXE (PID: 1068)
Executes application which crashes
EQNEDT32.EXE (PID: 1068)
INFO
Checks supported languages
EXCEL.EXE (PID: 1016)
ntvdm.exe (PID: 1328)
Reads the computer name
EXCEL.EXE (PID: 1016)
Reads Microsoft Office registry keys
EXCEL.EXE (PID: 1016)
Threats
PID
Process
Class
Message
1068
EQNEDT32.EXE
A Network Trojan was detected
ET TROJAN Possible Malicious Macro DL EXE Feb 2016
1068
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO Suspicious GET Request with Possible COVID-19 URI M1