File name: | Shipping Documents.xls |
Full analysis: | https://app.any.run/tasks/43fdc740-50e1-4094-b37b-058149371974 |
Verdict: | Malicious activity |
Analysis date: | January 11, 2019, 12:01:25 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Jan 8 00:31:50 2019, Last Saved Time/Date: Tue Jan 8 00:31:55 2019, Security: 0 |
MD5: | 3FE5822E1639FE108C5F500A08070FEC |
SHA1: | 055297F82C9A71F0738DC7784C98C2EC2D1CE8CC |
SHA256: | F40CA3042EAD1FF6FFB27833A91487B967C070FC6C5C1B478F9E0EF79E8BFEF3 |
SSDEEP: | 1536:Bk3hOdsylKlgryzc4bNhZFGzE+cL2knABsjRUPcspcwucbHcAgcJXcHhcN6kca0q:Bk3hOdsylKlgryzc4bNhZFGzE+cL2knc |
.xls | | | Microsoft Excel sheet (48) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (39.2) |
CompObjUserType: | Microsoft Excel 2003 Worksheet |
---|---|
CompObjUserTypeLen: | 31 |
HeadingPairs: |
|
TitleOfParts: | Sheet1 |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 15 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
ModifyDate: | 2019:01:08 00:31:55 |
CreateDate: | 2019:01:08 00:31:50 |
Software: | Microsoft Excel |
LastModifiedBy: | - |
Author: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2836 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
2720 | C:\Users\admin\AppData\Local\Temp\temp.com | C:\Users\admin\AppData\Local\Temp\temp.com | EXCEL.EXE | |
User: admin Company: Heaventools Software Integrity Level: MEDIUM Description: PE Explorer Version: 1.99.6.1400 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2836 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR9457.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2836 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF78DF63A14D2C906F.TMP | — | |
MD5:— | SHA256:— | |||
2836 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF81379F35E3FE8D2E.TMP | — | |
MD5:— | SHA256:— | |||
2836 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\temp.com | executable | |
MD5:6DDFA1EB3CA51C4A39CE5AF87EFD5251 | SHA256:3275519930D26C36EB00EAF6575D288A5EB8DDACE20E7CC3482AD8BB6B7C75DC | |||
2836 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@friendpaste[1].txt | text | |
MD5:77B07B7F11C6F9258950F33D596A5B6D | SHA256:0297E5090C8886A79623DFA7488497C0B5B53AE45076402DF553A371F2F426C8 | |||
2836 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\raw[1].txt | text | |
MD5:F9404C30E947604E021AF0FAA500870C | SHA256:EA6C71C1872E0B246E3811FB5314CBBB9A6D9920C5556562CFE2EF4DBAC7B20A |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2836 | EXCEL.EXE | 149.202.176.20:443 | friendpaste.com | OVH SAS | FR | unknown |
Domain | IP | Reputation |
---|---|---|
friendpaste.com |
| unknown |