Windows Analysis Report
Purchase Order # PO-00159.xla.xlsx

Overview

General Information

Sample name: Purchase Order # PO-00159.xla.xlsx
Analysis ID: 1446722
MD5: a2e27ccfd115281542473a2a75817b7b
SHA1: 6fe6c950003d0d574741d68dcaad6f19e76a296e
SHA256: 405173d3f4b78123bdb8d7d14009fe634d7ad45294032b94690836702f2216c7
Tags: xlaxlsx
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Excel sheet contains many unusual embedded objects
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Uses a known web browser user agent for HTTP communication

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Purchase Order # PO-00159.xla.xlsx ReversingLabs: Detection: 13%
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: qr-in.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.96.3:80
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /YXcuqXy HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qr-in.comConnection: Keep-Alive
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BB4DC9C1.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /YXcuqXy HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qr-in.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: qr-in.com
Source: Purchase Order # PO-00159.xla.xlsx, 69930000.0.dr String found in binary or memory: http://qr-in.com/YXcuqXy

System Summary
barindex
Excel sheet contains many unusual embedded objects
Source: Purchase Order # PO-00159.xla.xlsx OLE: Microsoft Excel 2007+
Source: ~DFF6AD63B7AC6BEEB6.TMP.0.dr OLE: Microsoft Excel 2007+
Source: ~DF5D105711B4331728.TMP.0.dr OLE: Microsoft Excel 2007+
Source: 69930000.0.dr OLE: Microsoft Excel 2007+
Document contains embedded VBA macros
Source: Purchase Order # PO-00159.xla.xlsx OLE indicator, VBA macros: true
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~DFF6AD63B7AC6BEEB6.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DF5D105711B4331728.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: classification engine Classification label: mal52.winXLSX@1/12@1/1
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$Purchase Order # PO-00159.xla.xlsx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR7722.tmp Jump to behavior
Source: Purchase Order # PO-00159.xla.xlsx OLE indicator, Workbook stream: true
Source: 69930000.0.dr OLE indicator, Workbook stream: true
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: Purchase Order # PO-00159.xla.xlsx ReversingLabs: Detection: 13%
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: ~DFF6AD63B7AC6BEEB6.TMP.0.dr Initial sample: OLE indicators vbamacros = False
Source: Purchase Order # PO-00159.xla.xlsx Initial sample: OLE indicators encrypted = True
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: Purchase Order # PO-00159.xla.xlsx Stream path 'Workbook' entropy: 7.99322703687 (max. 8.0)
Source: 69930000.0.dr Stream path 'Workbook' entropy: 7.98794374626 (max. 8.0)
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1446722 Sample: Purchase Order # PO-00159.x... Startdate: 23/05/2024 Architecture: WINDOWS Score: 52 10 Multi AV Scanner detection for submitted file 2->10 12 Excel sheet contains many unusual embedded objects 2->12 5 EXCEL.EXE 31 43 2->5         started        process3 dnsIp4 8 qr-in.com 188.114.96.3, 49161, 80 CLOUDFLARENETUS European Union 5->8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.114.96.3
 qr-in.com European Union
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
qr-in.com 188.114.96.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://qr-in.com/YXcuqXy false
  • Avira URL Cloud: safe
 unknown