File name: | aaf9a1a6b78f9b571d256e6f3eabffdf01efb72e4da07b16fc79c868051701e1 |
Full analysis: | https://app.any.run/tasks/06bd30a2-a239-4732-9d02-e9daa6779dd1 |
Verdict: | Malicious activity |
Analysis date: | June 19, 2019, 13:00:35 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: (Word, Excel, TXT) Excel, Author: EducatedFool, Comments: ==== http://ExcelVBA.ru/ ===== Excel ICQ: 5836318 Skype: ExcelVBA.ru======================, Revision Number: 3204, Name of Creating Application: AddinUpdater, Create Time/Date: Sun Apr 7 20:47:15 2019, Last Saved Time/Date: Sun Apr 7 20:47:26 2019, Security: 0 |
MD5: | 10340B62FA32D125925558095B755AFA |
SHA1: | CEC9DDE20AFBD11F9D008DA5C4143B426A21EB0A |
SHA256: | AAF9A1A6B78F9B571D256E6F3EABFFDF01EFB72E4DA07B16FC79C868051701E1 |
SSDEEP: | 24576:3mmTkJrdbFDHH22NaHMuMSxm0rM3AYJxYQeUzDAGlki2wILpxsCyYh9zr0QlwStd:L4LQm |
.xls | | | Microsoft Excel sheet (36.8) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (30) |
.doc | | | Microsoft Word document (old ver.) (23.3) |
CompObjUserTypeLen: | 25 |
---|---|
CompObjUserType: | Microsoft Forms 2.0 Form |
Title: | Программа заполнения документов (Word, Excel, TXT) данными из таблицы Excel |
Author: | EducatedFool |
Comments: | ==== http://ExcelVBA.ru/ ===== Разработка макросов для Excel ICQ: 5836318 Skype: ExcelVBA.ru ====================== |
LastModifiedBy: | Игорь |
RevisionNumber: | 3204 |
Software: | AddinUpdater |
CreateDate: | 2019:04:07 19:47:15 |
ModifyDate: | 2019:04:07 19:47:26 |
Security: | None |
Company: | http://excelvba.ru/ |
AppVersion: | 14 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: |
|
HeadingPairs: |
|
CodePage: | Windows Cyrillic |
ICQ: | 58-36-318 |
E-mail: | [email protected] |
Skype: | ExcelVBA.ru |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3516 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3516 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR40C5.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3516 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\msoABA6.tmp | — | |
MD5:— | SHA256:— | |||
3516 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\msoABB6.tmp | — | |
MD5:— | SHA256:— | |||
3516 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF962FE9B501A35BF1.TMP | — | |
MD5:— | SHA256:— | |||
3516 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF1C41AB516F6800B9.TMP | — | |
MD5:— | SHA256:— | |||
3516 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF5BFA261A723CF902.TMP | — | |
MD5:— | SHA256:— | |||
3516 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF354E59FC05E8B300.TMP | — | |
MD5:— | SHA256:— | |||
3516 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF003131CE6C27E0E0.TMP | — | |
MD5:— | SHA256:— | |||
3516 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFA611795C63E36FE0.TMP | — | |
MD5:— | SHA256:— | |||
3516 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF224161E2A9D17BA1.TMP | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3516 | EXCEL.EXE | POST | 200 | 51.254.21.170:80 | http://excelvba.ru/php2/updates.php | FR | text | 262 b | whitelisted |
3516 | EXCEL.EXE | POST | 200 | 51.254.21.170:80 | http://excelvba.ru/php2/updates.php | FR | text | 96 b | whitelisted |
3516 | EXCEL.EXE | GET | 200 | 51.254.21.170:80 | http://excelvba.ru/resources/FillDocuments/ExcelTable.xls | FR | document | 42.5 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3516 | EXCEL.EXE | 51.254.21.170:80 | excelvba.ru | OVH SAS | FR | malicious |
Domain | IP | Reputation |
---|---|---|
excelvba.ru |
| whitelisted |