Edit tour

Windows Analysis Report
Quotation.xls

Overview

General Information

Sample name:	Quotation.xls
Analysis ID:	1415005
MD5:	0cd0b71b219419b688ecd6599223639a
SHA1:	fde7e33898b73304755f1cff8578139f34246e23
SHA256:	3a23b616a5944735ffa156ebfba3fcf8debec466c00687a52ecdbde03b2bd94a
Tags:	Quotationxls
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Yara detected MalDoc

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Document misses a certain OLE stream usually present in this Microsoft Office document type

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 3028 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

AcroRd32.exe (PID: 1872 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding MD5: 2F8D93826B8CBF9290BC57535C7A6817)

RdrCEF.exe (PID: 3188 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 326A645391A97C760B60C558A35BB068)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Quotation.xls	JoeSecurity_MalDoc_4	Yara detected MalDoc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.246.40, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3028, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49163, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3028, Protocol: tcp, SourceIp: 13.107.246.40, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3028, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• AV Detection
• Compliance
• Spreading
• Software Vulnerabilities
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Quotation.xls	Virustotal: Detection: 20%			Perma Link
Source: Quotation.xls	ReversingLabs: Detection: 13%

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.22:49164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.168.2.22:49165 -> 13.107.246.40:443 version: TLS 1.2

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Directory queried: number of queries: 1007

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Source: global traffic

DNS query: name: 2s.gg

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 13.107.246.40:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 13.107.246.40:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 13.107.246.40:80
Source: global traffic	TCP traffic: 13.107.246.40:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 13.107.246.40:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 13.107.246.40:80
Source: global traffic	TCP traffic: 13.107.246.40:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 13.107.246.40:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 13.107.246.40:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 13.107.246.40:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 13.107.246.40:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 13.107.246.40:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 13.107.246.40:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 13.107.246.40:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 13.107.246.40:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 13.107.246.40:80
Source: global traffic	TCP traffic: 13.107.246.40:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 13.107.246.40:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 13.107.246.40:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 13.107.246.40:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 13.107.246.40:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 13.107.246.40:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 13.107.246.40:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443
Source: global traffic	TCP traffic: 13.107.246.40:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 13.107.246.40:443

Networking

Yara detected MalDoc

Source: Yara match

File source: Quotation.xls, type: SAMPLE

Source: Joe Sandbox View

IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1

Source: global traffic	HTTP traffic detected: GET /3zM HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 2s.ggConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /3zM HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 2s.ggConnection: Keep-Alive

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D9D8387D.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /3zM HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 2s.ggConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /3zM HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 2s.ggConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: 2s.gg

Source: Quotation.xls, CA130000.0.dr

String found in binary or memory: http://2s.gg/3zM1F2

Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164

Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.22:49164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.168.2.22:49165 -> 13.107.246.40:443 version: TLS 1.2

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 8

Screenshot OCR: document is protected 1 Ta 2 V, CD Open :he dckumenc h Mkromit cc Previewunq dcm "e rS 2 not a

Excel sheet contains many unusual embedded objects

Source: Quotation.xls	OLE: Microsoft Excel 2007+
Source: CA130000.0.dr	OLE: Microsoft Excel 2007+
Source: ~DF98F8EACBEB28D9F1.TMP.0.dr	OLE: Microsoft Excel 2007+

Source: Quotation.xls

OLE indicator, VBA macros: true

Source: Quotation.xls	Stream path 'MBD000EE583/\x1Ole' : http://2s.gg/3zM1F2\|Fmqa\>2DnD:)!5xs7C9yCm:~=>}Y#U{5,W&L6z<#B@%RdonZ13#o&^g/!&4tG<+xEEB3VG5aE0DU3EMOfBYmCQGIb1NxO6vDcLRY3i4I1dsTDn87JkVhZLDqd6o1c8TjSzTTlQWhSaWTiGlxGs6d8kDtjiEzsICrm3PH4I7JxGXtkjV0pXV9sqNK:&9,h+9GB6ao
Source: CA130000.0.dr	Stream path 'MBD000EE583/\x1Ole' : http://2s.gg/3zM1F2\|Fmqa\>2DnD:)!5xs7C9yCm:~=>}Y#U{5,W&L6z<#B@%RdonZ13#o&^g/!&4tG<+xEEB3VG5aE0DU3EMOfBYmCQGIb1NxO6vDcLRY3i4I1dsTDn87JkVhZLDqd6o1c8TjSzTTlQWhSaWTiGlxGs6d8kDtjiEzsICrm3PH4I7JxGXtkjV0pXV9sqNK:&9,h+9GB6ao

Source: ~DF98F8EACBEB28D9F1.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal68.troj.expl.winXLS@11/29@1/2

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6BAD.tmp

Jump to behavior

Source: Quotation.xls	OLE indicator, Workbook stream: true
Source: CA130000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: Quotation.xls	Virustotal: Detection: 20%
Source: Quotation.xls	ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: CA130000.0.dr

Initial sample: OLE indicators vbamacros = False

Source: Quotation.xls

Initial sample: OLE indicators encrypted = True

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Quotation.xls	Stream path 'MBD000EE580/CONTENTS' entropy: 7.9671168067 (max. 8.0)
Source: Quotation.xls	Stream path 'Workbook' entropy: 7.99593560374 (max. 8.0)
Source: CA130000.0.dr	Stream path 'MBD000EE580/CONTENTS' entropy: 7.9671168067 (max. 8.0)
Source: CA130000.0.dr	Stream path 'Workbook' entropy: 7.99791051376 (max. 8.0)

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Directory queried: number of queries: 1007

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	13 Exploitation for Client Execution	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	11 File and Directory Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	13 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Quotation.xls	21%	Virustotal		Browse
Quotation.xls	13%	ReversingLabs	Document-Office.Trojan.Sonbokli

Source	Detection	Scanner	Label	Link
2s.gg	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://2s.gg/3zM	0%	Avira URL Cloud	safe
http://2s.gg/3zM1F2	0%	Avira URL Cloud	safe
http://2s.gg/3zM	0%	Virustotal		Browse

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
2s.gg	13.107.246.40	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://2s.gg/3zM	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://2s.gg/3zM1F2	Quotation.xls, CA130000.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
13.107.246.40	2s.gg	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.255

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1415005
Start date and time:	2024-03-25 12:52:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Run name:	Without Instrumentation
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Quotation.xls
Detection:	MAL
Classification:	mal68.troj.expl.winXLS@11/29@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xls Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
Excluded IPs from analysis (whitelisted): 23.50.124.134, 23.207.202.183, 23.207.202.187, 23.207.202.196
Excluded domains from analysis (whitelisted): ssl.adobe.com.edgekey.net, armmf.adobe.com, e4578.dscb.akamaiedge.net, acroipm2.adobe.com.edgesuite.net, a122.dscd.akamai.net, acroipm2.adobe.com
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:53:34	API Interceptor	266x Sleep call for process: AcroRd32.exe modified
11:53:40	API Interceptor	86x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
13.107.246.40	https://pub-499de9e22147499d8e2a230fa85af8eb.r2.dev/brux.html	Get hash	malicious	HTMLPhisher	Browse
	https://pub-c220de8da8b04d34acb16070cfcd5baa.r2.dev/picture.html	Get hash	malicious	HTMLPhisher	Browse
	https://team-popping.github.io/support-team/	Get hash	malicious	TechSupportScam	Browse
	https://assets-usa.mkt.dynamics.com/404552f4-58e8-ee11-a1fa-00224832230e/digitalassets/standaloneforms/452d5cb4-60e8-ee11-a204-0022481c5f83	Get hash	malicious	Unknown	Browse
	https://0e2y6ylvqdmtdq.azureedge.net/01096/Wi0nAbh0help0secure037/index.html	Get hash	malicious	TechSupportScam	Browse
	http://8acs9yh98-frosty-disk-c127.emeraldfredia.workers.dev/#eduardo.olcesi@seaboardmarinepanama.com	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse
	GracehealthmiSMKB478467348838.rtf	Get hash	malicious	HTMLPhisher	Browse
	https://www.followmyhealth.com/PatientAccess?Organization=//V7mYkE8.worleyenterprise.com%2Fam9uYXRoYW4uZ3JlZWxleUB5b2dpcHJvZHVjdHMuY29t??&Invite=9MnjZPjvSBkWo1AJg0Su4CMECM3Gy2EqMLythemnkfrUifOZKY6iVLesbc/wYCFYSg4z04xrxoVh+YBkzkGlbNg6ZfZpnz2Fxa8Lq5YeHuI=	Get hash	malicious	HTMLPhisher	Browse
	https://lookerstudio.google.com/s/tH1czB4mrIU	Get hash	malicious	HTMLPhisher	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://crayoncolorsinc.uk/gd.PDF	Get hash	malicious	HTMLPhisher	Browse	52.96.19.82
	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.107.137.11
	SecuriteInfo.com.Win32.Evo-gen.9756.30202.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	SecuriteInfo.com.Win32.Evo-gen.7105.24636.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	https://pub-499de9e22147499d8e2a230fa85af8eb.r2.dev/brux.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	https://pub-b81b5bf862c04fa5982daffd9ca70d80.r2.dev/cc23.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	https://pub-c220de8da8b04d34acb16070cfcd5baa.r2.dev/picture.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	https://team-popping.github.io/support-team/	Get hash	malicious	TechSupportScam	Browse	13.107.246.71

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
36f7277af969a6947a61ae0b815907a1	qDhNH7gQYd.rtf	Get hash	malicious	AgentTesla	Browse	13.107.246.40
	fs-windows-agent-3.4.0.msi	Get hash	malicious	Unknown	Browse	13.107.246.40
	U9zp8kE2Ih.rtf	Get hash	malicious	AgentTesla	Browse	13.107.246.40
	S6uuXUf35G.rtf	Get hash	malicious	AgentTesla	Browse	13.107.246.40
	GGeXCPkc7J.rtf	Get hash	malicious	AgentTesla	Browse	13.107.246.40
	ioj7OUCNvF.rtf	Get hash	malicious	AgentTesla	Browse	13.107.246.40
	PO-3073529-HPL.xls	Get hash	malicious	AgentTesla	Browse	13.107.246.40
	PO.xls	Get hash	malicious	AgentTesla	Browse	13.107.246.40
	SecuriteInfo.com.Exploit.ShellCode.69.7870.25770.rtf	Get hash	malicious	AgentTesla	Browse	13.107.246.40

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	modified
Size (bytes):	270336
Entropy (8bit):	0.0018811398465979306
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE4ltwCZq:/M/xT02z7Oz
MD5:	E356C76ACF3317D02705149284017DF1
SHA1:	7871F5D21209DD63E2228F369A9D5F153D70DE16
SHA-256:	90FA1ADC9A3BB3EEB568406F7A4B2FA9E98EBBF58089853DD88745F3B4F9F3BD
SHA-512:	2B9A0491A4096B02D3CC1C06A8BA28077A9F804E92DAB7F4526ED9E216D899C6B9461A51436678DDB86F82F509945F9679DF11D921CB7BDBE494B5D19E9D0388
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	884312
Entropy (8bit):	1.2944965349348616
Encrypted:	false
SSDEEP:	1536:W3dki8JungPuzcn6F1Tny9Cie/koPs9h9RHJFUrnT15vWP5cPpmJ2dvRaQq3vMog:Hux/ZiOE85e+8J2dvRcvMyw
MD5:	9ABE7EB352E0DB96B52C99AC2FDEA85F
SHA1:	8DC45D02308275BA32B7FFB320A3042256D40C8B
SHA-256:	EC022DFF1CC8251BA9D849C16431914635473FC5457AE73AA277651B47948869
SHA-512:	E43325B927F5365F16118B67E1830B2A0E8CC051D9AEAB144DA6A75751CA39CC1831158270A50ED31BCCBA29C98A56769E516F36C45CB5FAA1BB6ED92CC0A5EB
Malicious:	false
Preview:	....l............................2...... EMF....X~..........................8...X....................?...........................................2......................Q....}..........................................P...(...x...$}...... ....2......(...................$}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Sun Mar 24 17:45:21 2024, Security: 1
Entropy (8bit):	7.444659639727352
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	Quotation.xls
File size:	325'120 bytes
MD5:	0cd0b71b219419b688ecd6599223639a
SHA1:	fde7e33898b73304755f1cff8578139f34246e23
SHA256:	3a23b616a5944735ffa156ebfba3fcf8debec466c00687a52ecdbde03b2bd94a
SHA512:	4f100911dd165722b710438510ca61b7541d22c9c25a2df59f2c5f49ad40ed789b6754f143930dee88bf45f063d0ed2548e97713f29ccd13db24f9b03493308a
SSDEEP:	6144:ZyunhXx+oY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVqIMIlSD3Sclx/nTOtB:ZzhXx+l3bVqIMIlSDicj6Is
TLSH:	EF64E151BE91874AE85607754DFB4A9A6325FC41AF524F0F324CF71D3EB03A44E2BA22
File Content Preview:	........................>.......................................................G...H...{......................................................................................................................................................................

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-03-24 17:45:21
Creating Application:	Microsoft Excel
Security:	1

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0 .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 83 ee 8e c0 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 83 ee 0b e3 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 83 ee 8f 13 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 83 ee 81 99 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2920681057018664
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . . ~ . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

General
Stream Path:	MBD000EE580/\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	MBD000EE580/\x1Ole
CLSID:
File Type:	data
Stream Size:	62
Entropy:	2.7788384466112834
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . ! . . . . . S h e e t 2 ! O b j e c t 3 .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 2e 00 00 00 04 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 00 00 00 21 00 10 00 00 00 53 68 65 65 74 32 21 4f 62 6a 65 63 74 20 33 00

General
Stream Path:	MBD000EE580/CONTENTS
CLSID:
File Type:	PDF document, version 1.7, 1 pages
Stream Size:	20909
Entropy:	7.967116806702583
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 7 . % . 1 0 o b j . < < . / T y p e / C a t a l o g . / P a g e s 2 0 R . / A c r o F o r m 3 0 R . > > . e n d o b j . 4 0 o b j . < < . / P r o d u c e r ( 3 . 0 . 4 \\ ( 5 . 0 . 8 \\ ) ) . / M o d D a t e ( D : 2 0 2 3 0 9 2 2 0 3 2 2 4 8 + 0 2 ' 0 0 ' ) . > > . e n d o b j . 2 0 o b j . < < . / T y p e / P a g e s . / K i d s [ 5 0 R ] . / C o u n t 1 . > > . e n d o b j . 3 0 o b j . < < . / F i e l d s [ ] . / D R 6 0 R . > > . e n d
Data Raw:	25 50 44 46 2d 31 2e 37 0a 25 f6 e4 fc df 0a 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 0a 2f 50 61 67 65 73 20 32 20 30 20 52 0a 2f 41 63 72 6f 46 6f 72 6d 20 33 20 30 20 52 0a 3e 3e 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 50 72 6f 64 75 63 65 72 20 28 33 2e 30 2e 34 20 5c 28 35 2e 30 2e 38 5c 29 20 29 0a 2f 4d 6f 64 44 61 74 65

General
Stream Path:	MBD000EE581/\x1CompObj
CLSID:
File Type:	data
Stream Size:	113
Entropy:	3.9544012817407785
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . / . . . M i c r o s o f t O f f i c e E x c e l M a c r o - E n a b l e d W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2f 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 4d 61 63 72 6f 2d 45 6e 61 62 6c 65 64 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	MBD000EE581/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	11603
Entropy:	7.129143775443908
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . h f . . . 6 . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 68 cf de 66 81 01 00 00 36 05 00 00 13 00 cc 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 c8 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	MBD000EE582/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

General
Stream Path:	MBD000EE582/\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	708
Entropy:	3.6235698530352805
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , D . . . . . . . . . . + , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . 0 . . . . . . . 8 . . . . . . . @ . . . . . . . H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 44 00 00 00 05 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 20 02 00 00 dc 01 00 00 14 00 00 00 01 00 00 00 a8 00 00 00 02 00 00 00 b0 00 00 00 03 00 00 00 bc 00 00 00 0e 00 00 00 c8 00 00 00 0f 00 00 00 d4 00 00 00 04 00 00 00 e0 00 00 00 05 00 00 00

General
Stream Path:	MBD000EE582/\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	23248
Entropy:	3.023529376533741
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . Z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . . . . . 4 . . . . . . . < . . . . . . . D . . . . . . . L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v i v i e n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 5a 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 a4 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 c0 00 00 00 06 00 00 00 cc 00 00 00 07 00 00 00 d8 00 00 00 08 00 00 00 e4 00 00 00 09 00 00 00 f4 00 00 00

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Quotation.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF635a70.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.2600

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.2600

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1A7B9C93.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5368C96D.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9B60201C.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A838A88A.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BAB1AC5A.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D9D8387D.emf

C:\Users\user\AppData\Local\Temp\~DF226F2E135FB0135F.TMP

C:\Users\user\AppData\Local\Temp\~DF75041B55012CC114.TMP

C:\Users\user\AppData\Local\Temp\~DF8E5FABF99440F259.TMP

Windows Analysis Report
Quotation.xls

General
Stream Path:	MBD000EE582/Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	97808
Entropy:	7.365164212626042
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . 9 1 9 7 4 B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . P . 9 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . . . . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c9 00 02 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 00 39 31 39 37 34 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

General
Stream Path:	MBD000EE583/\x1Ole
CLSID:
File Type:	data
Stream Size:	578
Entropy:	5.890730367113106
Base64 Encoded:	False
Data ASCII:	. . . . h . ] ~ . . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . : . / . / . 2 . s . . . g . g . / . 3 . z . M . . . 1 F 2 . \| F m q . a \\ > 2 D n D : ) ! 5 x . s 7 . . . C . . 9 y C m . : ~ = > . } . Y # U { * 5 . , W & L . 6 z < . . # B @ . % R d o n . . Z 1 3 . . . . # o & * . . . . P . . g / ! & . 4 t G < + . . . . . . . . . . . . . . . . . . . x . E . E . B . 3 . V . G . 5 . a . E . 0 . D . U . 3 . E . M . O . f . B . Y . m . C . Q . G . I . b . 1 . N . x . O . 6 . v . D . c . L . R .
Data Raw:	01 00 00 02 83 68 0f 5d 88 7e dc 17 00 00 00 00 00 00 00 00 00 00 00 00 ee 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b ea 00 00 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 32 00 73 00 2e 00 67 00 67 00 2f 00 33 00 7a 00 4d 00 00 00 31 46 32 fc aa cd ee d8 96 7c 46 d4 6d f1 a1 71 0a dc 61 5c f0 3e 32 be 81 af 44 6e 44 9d 85 3a 29 83 ef 21 be 35 bc 9d 78 1c a9 d2 ee 73

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	151279
Entropy:	7.995935603742815
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . j l E q m J . 2 D = z . d . < m h 1 z A ^ Y G . P . . . . . . . . . . . . \\ . p . v = . U Z v . & " . D > J f o l - } p f . . . . 0 k F a . . . ? w ^ O ] 8 [ . N C % * . n . ; { o m 4 . 5 _ D i h B . . . $ a . . . . . . . = . . . . ^ v 9 . . . . . ~ M E T m . . . . . . . . i . . . . v . . . . . . . D . . . . l = . . . Q d N K . ~ B 5 @ . . . . . . m " . . . { . . . . } [ . . . . ) . . . 4 1 . . . ; t 7 . D . t . 8 _ . . . U d @ ~ o 1 . . . l { . A { . =
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 af fa 6a a9 95 e7 6c fe 45 b9 71 6d 4a 07 32 89 f2 ca 44 3d 7a 81 04 64 14 3c bc 8a 6d 68 c6 31 b4 7a 41 5e 8f 59 47 1e 85 50 94 af 90 a1 c2 9b e1 00 02 00 b0 04 c1 00 02 00 9d 16 e2 00 00 00 5c 00 70 00 76 dd 3d f3 1c c3 55 5a a5 76 db c4 8a f7 af 26 22 9b 04 a1 e5 a7 44 3e 4a 9b a3 66 6f 6c

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	523
Entropy:	5.281635851471027
Base64 Encoded:	True
Data ASCII:	I D = " { 7 B 2 E 2 6 F 5 - 3 2 E 2 - 4 7 A 9 - 9 6 6 0 - A E 8 9 E 9 7 7 2 4 B C } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 6 5 6 7 8 6 5 4 B A 7 6 B E 7 6 B
Data Raw:	49 44 3d 22 7b 37 42 32 45 32 36 46 35 2d 33 32 45 32 2d 34 37 41 39 2d 39 36 36 30 2d 41 45 38 39 45 39 37 37 32 34 42 43 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.9874635293076497
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.364380970389258
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . 4 . h . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 34 ba 0e 68 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2024 12:53:27.265935898 CET	49163	80	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:27.366673946 CET	80	49163	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:27.366753101 CET	49163	80	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:27.367100954 CET	49163	80	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:27.466829062 CET	80	49163	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:27.467048883 CET	80	49163	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:27.471324921 CET	49163	80	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:27.477732897 CET	49164	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:27.477799892 CET	443	49164	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:27.477880001 CET	49164	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:27.484338999 CET	49164	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:27.484373093 CET	443	49164	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:27.795260906 CET	443	49164	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:27.795351028 CET	49164	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:27.800404072 CET	49164	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:27.800416946 CET	443	49164	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:27.800777912 CET	443	49164	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:27.803292036 CET	49164	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:27.928618908 CET	49164	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:27.928736925 CET	443	49164	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:27.928791046 CET	49164	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:51.913686037 CET	49163	80	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:52.014431000 CET	80	49163	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:52.014487982 CET	49163	80	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:52.015697956 CET	49165	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:52.015716076 CET	443	49165	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:52.015765905 CET	49165	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:52.018040895 CET	49165	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:52.018059015 CET	443	49165	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:52.334033012 CET	443	49165	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:52.334109068 CET	49165	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:52.339633942 CET	49165	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:52.339648962 CET	443	49165	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:52.339968920 CET	443	49165	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:52.340019941 CET	49165	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:52.344600916 CET	49165	443	192.168.2.22	13.107.246.40
Mar 25, 2024 12:53:52.344671011 CET	443	49165	13.107.246.40	192.168.2.22
Mar 25, 2024 12:53:52.344723940 CET	49165	443	192.168.2.22	13.107.246.40

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2024 12:53:04.084023952 CET	138	138	192.168.2.22	192.168.2.255
Mar 25, 2024 12:53:27.150363922 CET	54562	53	192.168.2.22	8.8.8.8
Mar 25, 2024 12:53:27.256373882 CET	53	54562	8.8.8.8	192.168.2.22
Mar 25, 2024 12:53:52.128031015 CET	137	137	192.168.2.22	192.168.2.255
Mar 25, 2024 12:53:52.877669096 CET	137	137	192.168.2.22	192.168.2.255
Mar 25, 2024 12:53:53.627680063 CET	137	137	192.168.2.22	192.168.2.255
Mar 25, 2024 12:54:01.120549917 CET	137	137	192.168.2.22	192.168.2.255
Mar 25, 2024 12:54:01.870158911 CET	137	137	192.168.2.22	192.168.2.255
Mar 25, 2024 12:54:02.620223045 CET	137	137	192.168.2.22	192.168.2.255
Mar 25, 2024 12:54:03.835768938 CET	137	137	192.168.2.22	192.168.2.255
Mar 25, 2024 12:54:04.585303068 CET	137	137	192.168.2.22	192.168.2.255
Mar 25, 2024 12:54:05.335411072 CET	137	137	192.168.2.22	192.168.2.255
Mar 25, 2024 12:55:03.768484116 CET	138	138	192.168.2.22	192.168.2.255

Timestamp	Bytes transferred	Direction	Data
Mar 25, 2024 12:53:27.367100954 CET	315	OUT	GET /3zM HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 2s.gg Connection: Keep-Alive
Mar 25, 2024 12:53:27.467048883 CET	274	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 25 Mar 2024 11:53:27 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Location: https://2s.gg/3zM x-azure-ref: 20240325T115327Z-ybudv4vsrp4sv0hhd7uf0yttks00000003yg00000001c9gz X-Cache: CONFIG_NOCACHE
Mar 25, 2024 12:53:51.913686037 CET	315	OUT	GET /3zM HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 2s.gg Connection: Keep-Alive
Mar 25, 2024 12:53:52.014431000 CET	274	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 25 Mar 2024 11:53:51 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Location: https://2s.gg/3zM x-azure-ref: 20240325T115351Z-ybudv4vsrp4sv0hhd7uf0yttks00000003yg00000001cc2u X-Cache: CONFIG_NOCACHE