analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

2288151726.xls

Full analysis: https://app.any.run/tasks/82c28674-c460-4385-bfc9-e417f38f08e7
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: September 30, 2020, 01:52:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
trojan
loader
maldoc-42
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Sep 29 12:36:11 2020, Security: 0
MD5:

4C931F62D33AE453DEC181829C54C16A

SHA1:

75091EC4697D66458A30E182EE822E42EA8D9817

SHA256:

E66208FEFF3B29541CB5C78A107CA3BF7AD6289CB4DF650199D72890880BC41B

SSDEEP:

1536:j/7uDphYHceXVhca+fMHLtyeGxcl8/dgKD6yzsFyBCKHtfBE:j/7uDphYHceXVhca+fMHLtyeGxcl8/ds

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Feryrtc.exe (PID: 4084)
    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 316)
    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 316)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 316)
    • Reads Internet Cache Settings

      • EXCEL.EXE (PID: 316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (78.9)

EXIF

FlashPix

Author: -
LastModifiedBy: -
Software: Microsoft Excel
CreateDate: 2006:09:16 00:00:00
ModifyDate: 2020:09:29 11:36:11
Security: None
CodePage: Windows Cyrillic
AppVersion: 14
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • DocuSign®
  • Лист1
  • Лист2
  • Лист3
HeadingPairs:
  • Листы
  • 3
  • Макросы Excel 4.0
  • 1
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start excel.exe feryrtc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
4084"C:\Asuses\gramyuta\Feryrtc.exe" C:\Asuses\gramyuta\Feryrtc.exeEXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
608
Read events
555
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
316EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR76D6.tmp.cvr
MD5:
SHA256:
316EXCEL.EXEC:\Asuses\gramyuta\Feryrtc.exeexecutable
MD5:AE7CDC9AB4A1B69ECDB544CEB44E06AC
SHA256:B0B49772F7AD0F7A10715B0874A7FE7CDF8EB71DA9E07BDAC530873DC119F2A8
316EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\88888[1].pngexecutable
MD5:AE7CDC9AB4A1B69ECDB544CEB44E06AC
SHA256:B0B49772F7AD0F7A10715B0874A7FE7CDF8EB71DA9E07BDAC530873DC119F2A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
316
EXCEL.EXE
GET
200
41.185.103.105:80
http://www.designerconceptsonline.co.za/vauwvgmkcuw/88888.png
ZA
executable
231 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
316
EXCEL.EXE
41.185.103.105:80
www.designerconceptsonline.co.za
webafrica
ZA
malicious

DNS requests

Domain
IP
Reputation
www.designerconceptsonline.co.za
  • 41.185.103.105
malicious

Threats

PID
Process
Class
Message
316
EXCEL.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
316
EXCEL.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
316
EXCEL.EXE
A Network Trojan was detected
ET TROJAN JS/WSF Downloader Dec 08 2016 M4
316
EXCEL.EXE
A Network Trojan was detected
AV POLICY EXE or DLL in HTTP Image Content Inbound - Likely Malicious
316
EXCEL.EXE
Misc activity
ET INFO EXE - Served Attached HTTP
316
EXCEL.EXE
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
No debug info