Windows Analysis Report
LHER000698175.xls

Overview

General Information

Sample name: LHER000698175.xls
Analysis ID: 1446721
MD5: 4816c91c7315f48b5fbb776d90316a0f
SHA1: 1e743a1cfe0d2ec9234f90551274759d59ded6bf
SHA256: bff53c74bf4fb85ebe5ad269a1c8ecf2e0f03b026faa29c34683d21f13c1011e
Tags: xls
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Excel sheet contains many unusual embedded objects
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Uses a known web browser user agent for HTTP communication

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: LHER000698175.xls ReversingLabs: Detection: 15%
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: qr-in.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /JeYCrvM HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qr-in.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /JeYCrvM HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qr-in.comConnection: Keep-AliveCookie: PHPSESSID=0c77kn3a08eub67r90e059mkpe
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CBFB6FE9.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /JeYCrvM HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qr-in.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /JeYCrvM HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qr-in.comConnection: Keep-AliveCookie: PHPSESSID=0c77kn3a08eub67r90e059mkpe
Source: global traffic DNS traffic detected: DNS query: qr-in.com
Source: LHER000698175.xls, 65130000.0.dr String found in binary or memory: http://qr-in.com/JeYCrvM
Source: LHER000698175.xls, D18F1661.emf.0.dr, ~DFA4A9D609ACFEE7BB.TMP.0.dr, ~DF4899799A00A7B9A1.TMP.0.dr, 65130000.0.dr, 781C84D6.png.0.dr String found in binary or memory: http://www.day.com/dam/1.0

System Summary
barindex
Excel sheet contains many unusual embedded objects
Source: LHER000698175.xls OLE: Microsoft Excel 2007+
Source: ~DF4899799A00A7B9A1.TMP.0.dr OLE: Microsoft Excel 2007+
Source: 65130000.0.dr OLE: Microsoft Excel 2007+
Document contains embedded VBA macros
Source: LHER000698175.xls OLE indicator, VBA macros: true
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~DF4899799A00A7B9A1.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: classification engine Classification label: mal52.winXLS@1/10@1/1
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\65130000 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR7445.tmp Jump to behavior
Source: LHER000698175.xls OLE indicator, Workbook stream: true
Source: 65130000.0.dr OLE indicator, Workbook stream: true
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: LHER000698175.xls ReversingLabs: Detection: 15%
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: ~DF4899799A00A7B9A1.TMP.0.dr Initial sample: OLE indicators vbamacros = False
Source: LHER000698175.xls Initial sample: OLE indicators encrypted = True
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: LHER000698175.xls Stream path 'MBD000E5130/Package' entropy: 7.95029125714 (max. 8.0)
Source: LHER000698175.xls Stream path 'Workbook' entropy: 7.990006136 (max. 8.0)
Source: ~DF4899799A00A7B9A1.TMP.0.dr Stream path 'Package' entropy: 7.94164766249 (max. 8.0)
Source: 65130000.0.dr Stream path 'MBD000E5130/Package' entropy: 7.94164766249 (max. 8.0)
Source: 65130000.0.dr Stream path 'Workbook' entropy: 7.99694987933 (max. 8.0)
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1446721 Sample: LHER000698175.xls Startdate: 23/05/2024 Architecture: WINDOWS Score: 52 10 Multi AV Scanner detection for submitted file 2->10 12 Excel sheet contains many unusual embedded objects 2->12 5 EXCEL.EXE 57 36 2->5         started        process3 dnsIp4 8 qr-in.com 188.114.96.3, 49163, 49164, 80 CLOUDFLARENETUS European Union 5->8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.114.96.3
 qr-in.com European Union
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
qr-in.com 188.114.96.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://qr-in.com/JeYCrvM false
  • Avira URL Cloud: safe
 unknown