analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

scan0611.xls

Full analysis: https://app.any.run/tasks/6f23410b-d78f-4c2f-9e17-27289eac22b2
Verdict: Malicious activity
Analysis date: September 11, 2019, 04:10:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
ole-embedded
macros-on-open
ta505
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: dqUz, Subject: DAdw, Author: y, Last Saved By: Microsoft Office, Revision Number: 344, Name of Creating Application: Microsoft Excel, Total Editing Time: 1d+19:57:00, Create Time/Date: Fri Aug 30 10:14:50 2019, Last Saved Time/Date: Tue Sep 10 11:39:02 2019, Number of Pages: 4, Number of Words: 2993, Number of Characters: 7158, Security: 0
MD5:

70C0FF03DD217EC9B441AB4A63DE0A07

SHA1:

AF3DCEA76E8EE415C76B5FCBFF87FDF4F44A3DAF

SHA256:

A06C8DA106F45CD4E6EE86655770DEADE256450AA6644AE733B2DC182031CAD4

SSDEEP:

6144:i8eVvfYWp+amy7P/IP2UikJ+GC1UcLS4kIOkCe:i86onamsXUfw5J9Ce

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • EXCEL.EXE (PID: 3508)
    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 3508)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Creates files in the user directory

      • EXCEL.EXE (PID: 3508)
    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3508)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

HeadingPairs:
  • Листы
  • 1
TitleOfParts: 1
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 11.9999
Paragraphs: 20
Lines: 525
Bytes: 34765
Company: -
CodePage: Windows Cyrillic
Security: None
Characters: 7158
Words: 2993
Pages: 4
ModifyDate: 2019:09:10 10:39:02
CreateDate: 2019:08:30 09:14:50
TotalEditTime: 1.8 days
Software: Microsoft Excel
RevisionNumber: 344
LastModifiedBy: Microsoft Office
Author: y
Subject: DAdw
Title: dqUz
CompObjUserType: Microsoft Forms 2.0 Form
CompObjUserTypeLen: 25
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
1
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start excel.exe

Process information

PID
CMD
Path
Indicators
Parent process
3508"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
Total events
682
Read events
577
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
3
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
3508EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR9AED.tmp.cvr
MD5:
SHA256:
3508EXCEL.EXEC:\Users\admin\AppData\Local\Temp\VBA30E.tmp
MD5:
SHA256:
3508EXCEL.EXEC:\Users\admin\AppData\Local\Temp\VBA30D.tmp
MD5:
SHA256:
3508EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DFF80AE0B5808507CF.TMP
MD5:
SHA256:
3508EXCEL.EXEC:\Users\admin\AppData\Local\Temp\83A61000
MD5:
SHA256:
3508EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DFEFDE70116B064066.TMP
MD5:
SHA256:
3508EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~$13.xlsx
MD5:
SHA256:
3508EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DFB48ED77955B517F3.TMP
MD5:
SHA256:
3508EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1203D355.emfemf
MD5:1F5022B6826BD78BA8A7EC014B6B8E5C
SHA256:27E040A5A8BF27C0FC0EB1D7E7FADD689E3DE34A00AA474F635AE97F05ECABB5
3508EXCEL.EXEC:\Users\admin\AppData\Local\Temp\13.xlsxdocument
MD5:E2C981DA5005169C49936A134C975F0E
SHA256:C53CBEFF996925D6E41C371AFB9F7389FA84ADDA6D49BCB80303738ADFAE4B20
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3508
EXCEL.EXE
95.216.147.100:443
windows-update-02-en.com
Hetzner Online GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
windows-update-02-en.com
  • 95.216.147.100
malicious

Threats

No threats detected
No debug info