analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

bill_001_1019.xls

Full analysis: https://app.any.run/tasks/437d161f-f6c3-4dde-80c2-de0cd8a0d9a1
Verdict: Malicious activity
Analysis date: December 02, 2019, 23:34:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
ole-embedded
macros-on-open
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Title: KyhyOY, Subject: gzhiIa, Author: ub, Last Saved By: Administrator, Revision Number: 190, Name of Creating Application: Microsoft Excel, Total Editing Time: 22:39:00, Create Time/Date: Fri Aug 30 10:14:50 2019, Last Saved Time/Date: Mon Dec 2 20:34:28 2019, Number of Pages: 4, Number of Words: 3564, Number of Characters: 6185, Security: 0
MD5:

76D03A86681BB26E4439F0206866F9D7

SHA1:

0D8084C78A588B759F0C8F5B5AD5A770463A7566

SHA256:

DED5B5F413C21447557A7A522680D3D4444F192CCB5F8EDEDE0104790AAA0AD4

SSDEEP:

24576:YcCjsnKG4wUWTZKmKsGrGi5olm9OYq9wY:tjzIR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • EXCEL.EXE (PID: 2812)
    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 2812)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Creates files in the user directory

      • EXCEL.EXE (PID: 2812)
    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

CompObjUserTypeLen: 25
CompObjUserType: Microsoft Forms 2.0 Form
Title: KyhyOY
Subject: gzhiIa
Author: ub
LastModifiedBy: Administrator
RevisionNumber: 190
Software: Microsoft Excel
TotalEditTime: 22.6 hours
CreateDate: 2019:08:30 09:14:50
ModifyDate: 2019:12:02 20:34:28
Pages: 4
Words: 3564
Characters: 6185
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
Bytes: 87537
Lines: 634
Paragraphs: 47
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: Page2
HeadingPairs:
  • Worksheets
  • 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
1
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start excel.exe

Process information

PID
CMD
Path
Indicators
Parent process
2812"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
Total events
673
Read events
535
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
3
Text files
0
Unknown types
5

Dropped files

PID
Process
Filename
Type
2812EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRA979.tmp.cvr
MD5:
SHA256:
2812EXCEL.EXEC:\Users\admin\AppData\Local\Temp\VBB2B3.tmp
MD5:
SHA256:
2812EXCEL.EXEC:\Users\admin\AppData\Local\Temp\VBB2B2.tmp
MD5:
SHA256:
2812EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DFAE4BBD337E583759.TMP
MD5:
SHA256:
2812EXCEL.EXEC:\Users\admin\AppData\Local\Temp\33B93000
MD5:
SHA256:
2812EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DF0840E0309AE4A0DE.TMP
MD5:
SHA256:
2812EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~$vds.xlsx
MD5:
SHA256:
2812EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DF6533A5D26A769805.TMP
MD5:
SHA256:
2812EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E5AC9063.emfemf
MD5:E16A806016925395CF510111F1179B15
SHA256:31CF4F12D4D843F5E6E41BEE96D21ED86A3E3DD5833D531E81EFE75B088C33F3
2812EXCEL.EXEC:\Users\admin\AppData\Local\Temp\oleObject1.binbinary
MD5:C69E9DD0302D34AF7961E115121F05FD
SHA256:0249680033FAADFD7F027E904911C9E0186F8F589CA96F6799FD1BC1C93CBFC4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2812
EXCEL.EXE
172.104.91.16:443
live-en.com
Linode, LLC
JP
malicious

DNS requests

Domain
IP
Reputation
live-en.com
  • 172.104.91.16
malicious

Threats

No threats detected
No debug info