File name: | planilla-de-excel-de-calendario-de-vacaciones-de-empleados.xlsm |
Full analysis: | https://app.any.run/tasks/cea6119b-6cc1-4645-8857-3a351a7778b2 |
Verdict: | Malicious activity |
Analysis date: | December 02, 2019, 18:37:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
File info: | Microsoft Excel 2007+ |
MD5: | 731F9A33A781BA332B580F7D445D5021 |
SHA1: | 400D326B6064CD8616D7C9180A97C20F9521EBC1 |
SHA256: | 9CDD4B9A407F87C523139B56F1687647D3DC6283BD230903952D118F1E4E947E |
SSDEEP: | 1536:2XA7e+1RacJt4PIqIXXXUYCaVaeyv9g+F7hqPdBgGGqsk:Mme+atPI6rKgG/Z |
.xlam | | | Excel Macro-enabled Open XML add-in (42.4) |
---|---|---|
.xlsm | | | Excel Microsoft Office Open XML Format document (with Macro) (29.2) |
.xlsx | | | Excel Microsoft Office Open XML Format document (17.3) |
.zip | | | Open Packaging Conventions container (8.9) |
.zip | | | ZIP compressed archive (2) |
AppVersion: | 15.03 |
---|---|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
Company: | IBM |
TitlesOfParts: |
|
HeadingPairs: |
|
ScaleCrop: | No |
DocSecurity: | None |
Application: | Microsoft Excel |
ModifyDate: | 2018:12:10 14:10:47Z |
CreateDate: | 2014:12:17 05:13:13Z |
LastModifiedBy: | Cecilia |
Creator: | Planilla Excel |
---|
ZipFileName: | [Content_Types].xml |
---|---|
ZipUncompressedSize: | 2756 |
ZipCompressedSize: | 526 |
ZipCRC: | 0x15fb0984 |
ZipModifyDate: | 1980:01:01 00:00:00 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0006 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2132 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
1972 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | EXCEL.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
1516 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1972 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2488 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2132 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRA766.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2132 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\plantillas[1].txt | — | |
MD5:— | SHA256:— | |||
1972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
1972 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
1516 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\54PPAGEX\plantillas[1].txt | — | |
MD5:— | SHA256:— | |||
1516 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:1FD00BBF8BDAB07E3D13FB0193879EB0 | SHA256:E2F3B6450C81CE8CA5584472A83E7C2EB0F08B71389595A5DC5CB86012B153D7 | |||
1516 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:3C9DDC6200CD37842C44091156128C33 | SHA256:2F076B75559F0EEC3D77B7D1DFB7AB3F14A8C3DC047F43C59A38FA19E2E5BD20 | |||
1516 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\54PPAGEX\f[1].txt | text | |
MD5:8CA941043AB68122DBF61378368B6DC5 | SHA256:54C8EBE494631C7369B03B022B2ED1055813FD549803A629206D425611EF72E4 | |||
1516 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\S2AYCA3G\css[1].txt | text | |
MD5:583EEB8C76FC402B59587BAE634C7C9D | SHA256:B94AD164BF353693418DAA002DEC81BEDFB4BA81CADB889FAC4C337E782AB349 | |||
2132 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\Excel8.0\MSForms.exd | tlb | |
MD5:3F583B9CA3801B894A0338C39BC669E4 | SHA256:282AF3677EDC31FD70D1F8922EF161993933E77FB43C9B1D0F1417C2C3067D3C |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1972 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2132 | EXCEL.EXE | 34.235.253.190:443 | www.planillaexcel.com | Amazon.com, Inc. | US | unknown |
1516 | iexplore.exe | 34.235.253.190:443 | www.planillaexcel.com | Amazon.com, Inc. | US | unknown |
1516 | iexplore.exe | 13.35.253.42:443 | platform-api.sharethis.com | — | US | malicious |
1516 | iexplore.exe | 104.17.64.4:443 | cdnjs.cloudflare.com | Cloudflare Inc | US | unknown |
1972 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
1516 | iexplore.exe | 172.217.16.170:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
1516 | iexplore.exe | 172.217.22.2:443 | pagead2.googlesyndication.com | Google Inc. | US | whitelisted |
1516 | iexplore.exe | 69.171.250.25:443 | connect.facebook.net | Facebook, Inc. | US | suspicious |
1516 | iexplore.exe | 104.20.2.47:443 | secure.statcounter.com | Cloudflare Inc | US | shared |
1516 | iexplore.exe | 157.240.20.35:443 | www.facebook.com | Facebook, Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
www.planillaexcel.com |
| suspicious |
www.bing.com |
| whitelisted |
platform-api.sharethis.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
cdnjs.cloudflare.com |
| whitelisted |
pagead2.googlesyndication.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
connect.facebook.net |
| whitelisted |
www.facebook.com |
| whitelisted |
secure.statcounter.com |
| whitelisted |