File name: | Shqyrtimi i taksave 2019 03172_k2.xls |
Full analysis: | https://app.any.run/tasks/22f37ba9-0dc9-4c25-bac0-e8785e5484d4 |
Verdict: | Malicious activity |
Analysis date: | January 17, 2020, 20:42:58 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Create Time/Date: Tue Nov 19 14:58:31 2019, Last Saved Time/Date: Wed Nov 20 21:49:32 2019, Security: 0 |
MD5: | B1D34757594DC11A3FA9F917083C4358 |
SHA1: | 0726DA8B5DF0D79B1D9CF73AE7ED6361C7FC183D |
SHA256: | E537F6064E582602E4F1E64A6FDBCE2C7A6FD923D7B39D91BC3C1B5052340210 |
SSDEEP: | 1536:+fQzl3ZpWh+QO3uMdS9dSttRJwyE/4XZlLAr+cd5UG:+fQzl3ZpWh+QO3uMdS9dSttRJwyE/4XI |
.xls | | | Microsoft Excel sheet (78.9) |
---|
CreateDate: | 2019:11:19 14:58:31 |
---|---|
ModifyDate: | 2019:11:20 21:49:32 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: |
|
HeadingPairs: |
|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1024 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
1524 | "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1188 | C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Application Error Reporting Version: 14.0.6015.1000 | ||||
3124 | C:\Windows\system32\dwwin.exe -x -s 1188 | C:\Windows\system32\dwwin.exe | — | DW20.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Watson Client Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1024 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRDFEF.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1024 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\3728984.cvr | sqm | |
MD5:14592A4FF51385FC5D532D4FAB239449 | SHA256:4C8C4E60AE284788A53C8D67B2910283861F21E0AFE8C03B8B0C165D152679B5 |