analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | b7d5e91025d20bf4579d14060cc8ec42756ac927719024e71c4e5892c234b9e0.xlsm |
| Full analysis: | https://app.any.run/tasks/c0836c66-39e6-49bc-8f88-2f78a3f0b92c |
| Verdict: | Malicious activity |
| Analysis date: | April 24, 2019, 02:33:13 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
| File info: | Microsoft Excel 2007+ |
| MD5: | 443670BB55005267F9B09CDC76B21705 |
| SHA1: | D21CDC5B66E9E8B32FED28E23DAE38FE3B16DF25 |
| SHA256: | B7D5E91025D20BF4579D14060CC8EC42756AC927719024E71C4E5892C234B9E0 |
| SSDEEP: | 384:HS1Qfs7SluQzkfXdS0LWHnp6dBCfouaTR5sjAswsQ:QQpuiko0LUS4AbSA |
MALICIOUS
Unusual execution from Microsoft Office
- EXCEL.EXE (PID: 3848)
SUSPICIOUS
No suspicious indicators.INFO
Reads Microsoft Office registry keys
- EXCEL.EXE (PID: 3848)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .xlsm | | | Excel Microsoft Office Open XML Format document (with Macro) (50.8) |
|---|---|---|
| .xlsx | | | Excel Microsoft Office Open XML Format document (30) |
| .zip | | | Open Packaging Conventions container (15.4) |
| .zip | | | ZIP compressed archive (3.5) |
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0006 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 1980:01:01 00:00:00 |
| ZipCRC: | 0x513599ac |
| ZipCompressedSize: | 367 |
| ZipUncompressedSize: | 1087 |
| ZipFileName: | [Content_Types].xml |
XMP
| Creator: | - |
|---|
XML
| CreateDate: | 2019:04:23 09:58:37Z |
|---|---|
| ModifyDate: | 2019:04:23 09:58:37Z |
| Application: | Microsoft Excel |
| DocSecurity: | None |
| ScaleCrop: | No |
| HeadingPairs: |
|
| TitlesOfParts: | Sheet1 |
| Company: | - |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| AppVersion: | 16.03 |
Total processes
33
Monitored processes
2
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 3848 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
| 3836 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Documents\sammylu.txt | C:\Windows\system32\NOTEPAD.EXE | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
610
Read events
572
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3848 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR2DE3.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3848 | EXCEL.EXE | C:\Users\admin\Documents\sammylu.txt | text | |
MD5:7D15091585DEA376CBCA87AFDAF2FC94 | SHA256:D3F734F22A2AB364B8C39927305B2D6C7FBB9E200A6BA67AC6E4DB90BA776080 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3848 | EXCEL.EXE | 103.235.46.39:443 | www.baidu.com | Beijing Baidu Netcom Science and Technology Co., Ltd. | HK | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.baidu.com |
| whitelisted |