Windows Analysis Report
NetCDF4Excel_3_3_setup.exe

Overview

General Information

Sample name: NetCDF4Excel_3_3_setup.exe
Analysis ID: 1543738
MD5: 943ea0a62b581f8e132b1fc33e04804d
SHA1: a28e6d970f44ce8e0fad92d6b86bf1ff5cbe9e75
SHA256: d7e140540766c60ed61f6ed9e0bb3c09cc3363d35bc6803c062a6e7f61db385a
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Document contains an embedded VBA with many string operations indicating source code obfuscation
Document contains an embedded VBA macro which executes code when the document is opened / closed
Drops PE files
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Queries the volume information (name, serial number etc) of a device
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Stores files to the Windows start menu directory
Uses 32bit PE files

Classification

Uses 32bit PE files
Source: NetCDF4Excel_3_3_setup.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Window detected: &InstallCancelNullsoft Install System v2.46Please review the license agreement before installing NetCDF4Excel. If you accept all terms of the agreement click the check box below. Click Install to start the installation.NetCDF4Excel : NetCDF add-in for ExcelCopyright (c) 2008-2016 Alexander Bruhns. All Rights Reserved.This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation either version 3 of the License or (at your option) any later version.This program is distributed in the hope that it will be useful but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.You should have received a copy of the GNU General Public License along with this program. If not see <http://www.gnu.org/licenses/>.NetCDF4Excel uses NetCDF : Copyright 1993-2008 University Corporation for Atmospheric Research/UnidataI accept
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:49731 version: TLS 1.2
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 13.107.246.60 13.107.246.60
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: global traffic HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: NetCDF4Excel_3_3_setup.exe, uninstaller.exe.0.dr String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: NetCDF4Excel_3_3_setup.exe, uninstaller.exe.0.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ~DF88F2325B87F19935.TMP.4.dr String found in binary or memory: http://www.gnu.0org/
Source: ~DF88F2325B87F19935.TMP.4.dr String found in binary or memory: http://www.gnu.o
Source: ~DF88F2325B87F19935.TMP.4.dr String found in binary or memory: http://www.gnu.or
Source: ~DF88F2325B87F19935.TMP.4.dr String found in binary or memory: http://www.gnu.org/licenses/
Source: ~DF88F2325B87F19935.TMP.4.dr String found in binary or memory: http://www.gnu.orgF/
Source: WefGallery[1]0.4.dr String found in binary or memory: https://github.com/OfficeDev/office-js/blob/release/LICENSE.md
Source: WefGallery[1]0.4.dr String found in binary or memory: https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:49731 version: TLS 1.2

System Summary
barindex
Document contains an embedded VBA macro with suspicious strings
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: ' ncId = NC_CreateFile(ncFileName)
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: NC_WriteFile False
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: NC_WriteFile True
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Public Declare Function SetEnvironmentVariable Lib "kernel32" Alias "SetEnvironmentVariableA" (ByVal lpName As String, ByVal lpValue As String) As Long
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Public Declare Function SetEnvironmentVariable Lib "kernel32" Alias "SetEnvironmentVariableA" (ByVal lpName As String, ByVal lpValue As String) As Long
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: '''Private Declare Function GetTickCount Lib "Kernel32" () As Long
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Public Function NC_CreateFile(ByVal ncFileName As String) As Long
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Err.Raise ERR_NBR__CANT_OPEN_NC_FILE, "NC_CreateFile", ERR_MSG__CANT_OPEN_NC_FILE & " " & ncFileName
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: NC_CreateFile = NC_OpenFile(ncFileName, NC_WRITE)
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: strArray = Split(Environ("PATH"), ";")
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: SetEnvironmentVariable "PATH", Environ("PATH") + ";" + Application.ActiveWorkbook.path
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: MsgBox ("Fatal Error : VbNc.dll not found! Please add path to VbNC.dll to system PATH environment variable." & vbNewLine & vbNewLine & "Actual Path is : " & Environ("PATH"))
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Public Sub NC_WriteFile(ByVal updateExistingFile As Boolean)
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: ncId = NC_CreateFile(ncFileName)
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: ' ncId = NC_CreateFile(ncFileName)
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: NC_WriteFile False
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: NC_WriteFile True
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Public Declare Function SetEnvironmentVariable Lib "kernel32" Alias "SetEnvironmentVariableA" (ByVal lpName As String, ByVal lpValue As String) As Long
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Public Declare Function SetEnvironmentVariable Lib "kernel32" Alias "SetEnvironmentVariableA" (ByVal lpName As String, ByVal lpValue As String) As Long
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: '''Private Declare Function GetTickCount Lib "Kernel32" () As Long
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Public Function NC_CreateFile(ByVal ncFileName As String) As Long
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Err.Raise ERR_NBR__CANT_OPEN_NC_FILE, "NC_CreateFile", ERR_MSG__CANT_OPEN_NC_FILE & " " & ncFileName
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: NC_CreateFile = NC_OpenFile(ncFileName, NC_WRITE)
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: strArray = Split(Environ("PATH"), ";")
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: SetEnvironmentVariable "PATH", Environ("PATH") + ";" + Application.ActiveWorkbook.path
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: MsgBox ("Fatal Error : VbNc.dll not found! Please add path to VbNC.dll to system PATH environment variable." & vbNewLine & vbNewLine & "Actual Path is : " & Environ("PATH"))
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Public Sub NC_WriteFile(ByVal updateExistingFile As Boolean)
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: ncId = NC_CreateFile(ncFileName)
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: ' ncId = NC_CreateFile(ncFileName)
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: NC_WriteFile False
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: NC_WriteFile True
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Public Declare Function SetEnvironmentVariable Lib "kernel32" Alias "SetEnvironmentVariableA" (ByVal lpName As String, ByVal lpValue As String) As Long
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Public Declare Function SetEnvironmentVariable Lib "kernel32" Alias "SetEnvironmentVariableA" (ByVal lpName As String, ByVal lpValue As String) As Long
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: '''Private Declare Function GetTickCount Lib "Kernel32" () As Long
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Public Function NC_CreateFile(ByVal ncFileName As String) As Long
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Err.Raise ERR_NBR__CANT_OPEN_NC_FILE, "NC_CreateFile", ERR_MSG__CANT_OPEN_NC_FILE & " " & ncFileName
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: NC_CreateFile = NC_OpenFile(ncFileName, NC_WRITE)
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: strArray = Split(Environ("PATH"), ";")
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: SetEnvironmentVariable "PATH", Environ("PATH") + ";" + Application.ActiveWorkbook.path
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: MsgBox ("Fatal Error : VbNc.dll not found! Please add path to VbNC.dll to system PATH environment variable." & vbNewLine & vbNewLine & "Actual Path is : " & Environ("PATH"))
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Public Sub NC_WriteFile(ByVal updateExistingFile As Boolean)
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: ncId = NC_CreateFile(ncFileName)
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel' : found possibly 'ADODB.Stream' functions open, read, write
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Common' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Interface' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Menu' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Write' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel' : found possibly 'ADODB.Stream' functions open, read, write
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Common' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Interface' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Menu' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Write' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel' : found possibly 'ADODB.Stream' functions open, read, write
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Common' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Interface' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Menu' : found possibly 'ADODB.Stream' functions mode, open, read, write
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Write' : found possibly 'ADODB.Stream' functions mode, open, read, write
Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Common' : found possibly 'WScript.Shell' functions environment, run, environ
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Menu' : found possibly 'WScript.Shell' functions environment, popup, environ
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Common' : found possibly 'WScript.Shell' functions environment, run, environ
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Menu' : found possibly 'WScript.Shell' functions environment, popup, environ
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Common' : found possibly 'WScript.Shell' functions environment, run, environ
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Menu' : found possibly 'WScript.Shell' functions environment, popup, environ
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: nc_close ncId
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: nc_close ncId
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: ' ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: ' nc_close ncId
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: ' nc_close ncId
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: nc_close ncId
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: nc_close ncId
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: ' ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: ' nc_close ncId
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Public Const ERR_NBR__CANT_OPEN_NC_FILE As Long = 600
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Public Const ERR_MSG__CANT_OPEN_NC_FILE As String = "Cannot open Netcdf file"
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: 'If nc_close(ncId) <> 0 Then
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: 'If nc_open(ncFileName, NC_WRITE, ncId) <> 0 Then
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Err.Raise ERR_NBR__CANT_OPEN_NC_FILE, "NC_CreateFile", ERR_MSG__CANT_OPEN_NC_FILE & " " & ncFileName
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: nc_close ncId
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: NC_CreateFile = NC_OpenFile(ncFileName, NC_WRITE)
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Public Function NC_OpenFile(ByVal ncFileName As String, ByVal mode As Long) As Long
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: If nc_open(ncFileName, mode, ncId) <> NC_NOERR Then
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Err.Raise ERR_NBR__CANT_OPEN_NC_FILE, "NC_OpenFile", ERR_MSG__CANT_OPEN_NC_FILE & " " & ncFileName
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: NC_OpenFile = ncId
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Public Declare Function nc_open Lib "VbNc.dll" (ByVal path As String, ByVal mode As Long, ByRef ncId As Long) As Long
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Public Declare Function nc_close Lib "VbNc.dll" (ByVal ncId As Long) As Long
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Attribute VB_Name = "NetCDF4Excel_Layout"
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_WRITE)
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: nc_close ncId
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Sub Workbook_Open()
Source: NetCDF4Excel_2007.xlsm.0.dr OLE, VBA macro line: Sub Workbook_BeforeClose(Cancel As Boolean)
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: nc_close ncId
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: nc_close ncId
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: ' ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: ' nc_close ncId
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: ' nc_close ncId
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: nc_close ncId
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: nc_close ncId
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: ' ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: ' nc_close ncId
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Public Const ERR_NBR__CANT_OPEN_NC_FILE As Long = 600
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Public Const ERR_MSG__CANT_OPEN_NC_FILE As String = "Cannot open Netcdf file"
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: 'If nc_close(ncId) <> 0 Then
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: 'If nc_open(ncFileName, NC_WRITE, ncId) <> 0 Then
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Err.Raise ERR_NBR__CANT_OPEN_NC_FILE, "NC_CreateFile", ERR_MSG__CANT_OPEN_NC_FILE & " " & ncFileName
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: nc_close ncId
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: NC_CreateFile = NC_OpenFile(ncFileName, NC_WRITE)
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Public Function NC_OpenFile(ByVal ncFileName As String, ByVal mode As Long) As Long
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: If nc_open(ncFileName, mode, ncId) <> NC_NOERR Then
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Err.Raise ERR_NBR__CANT_OPEN_NC_FILE, "NC_OpenFile", ERR_MSG__CANT_OPEN_NC_FILE & " " & ncFileName
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: NC_OpenFile = ncId
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Public Declare Function nc_open Lib "VbNc.dll" (ByVal path As String, ByVal mode As Long, ByRef ncId As Long) As Long
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Public Declare Function nc_close Lib "VbNc.dll" (ByVal ncId As Long) As Long
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Attribute VB_Name = "NetCDF4Excel_Layout"
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_WRITE)
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: nc_close ncId
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Sub Workbook_Open()
Source: 1AC88B16.tmp.4.dr OLE, VBA macro line: Sub Workbook_BeforeClose(Cancel As Boolean)
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: nc_close ncId
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: nc_close ncId
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: ' ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: ' nc_close ncId
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: ' nc_close ncId
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: nc_close ncId
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: nc_close ncId
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: ' ncId = NC_OpenFile(ncFileName, NC_NOWRITE)
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: ' nc_close ncId
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Public Const ERR_NBR__CANT_OPEN_NC_FILE As Long = 600
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Public Const ERR_MSG__CANT_OPEN_NC_FILE As String = "Cannot open Netcdf file"
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: 'If nc_close(ncId) <> 0 Then
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: 'If nc_open(ncFileName, NC_WRITE, ncId) <> 0 Then
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Err.Raise ERR_NBR__CANT_OPEN_NC_FILE, "NC_CreateFile", ERR_MSG__CANT_OPEN_NC_FILE & " " & ncFileName
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: nc_close ncId
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: NC_CreateFile = NC_OpenFile(ncFileName, NC_WRITE)
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Public Function NC_OpenFile(ByVal ncFileName As String, ByVal mode As Long) As Long
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: If nc_open(ncFileName, mode, ncId) <> NC_NOERR Then
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Err.Raise ERR_NBR__CANT_OPEN_NC_FILE, "NC_OpenFile", ERR_MSG__CANT_OPEN_NC_FILE & " " & ncFileName
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: NC_OpenFile = ncId
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Public Declare Function nc_open Lib "VbNc.dll" (ByVal path As String, ByVal mode As Long, ByRef ncId As Long) As Long
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Public Declare Function nc_close Lib "VbNc.dll" (ByVal ncId As Long) As Long
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Attribute VB_Name = "NetCDF4Excel_Layout"
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: ncId = NC_OpenFile(ncFileName, NC_WRITE)
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: nc_close ncId
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Sub Workbook_Open()
Source: ~DF88F2325B87F19935.TMP.4.dr OLE, VBA macro line: Sub Workbook_BeforeClose(Cancel As Boolean)
Uses 32bit PE files
Source: NetCDF4Excel_3_3_setup.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: mal60.expl.evad.winEXE@5/21@0/1
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe File created: C:\Program Files (x86)\NetCDF4Excel Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NetCDF4Excel Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe File created: C:\Users\user\AppData\Local\Temp\nsf5BB9.tmp Jump to behavior
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel' : VBA code
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Common' : VBA code
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Filter' : VBA code
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Interface' : VBA code
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Layout' : VBA code
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Menu' : VBA code
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Read' : VBA code
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Write' : VBA code
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel' : VBA code
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Common' : VBA code
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Filter' : VBA code
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Interface' : VBA code
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Layout' : VBA code
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Menu' : VBA code
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Read' : VBA code
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Write' : VBA code
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel' : VBA code
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Common' : VBA code
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Filter' : VBA code
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Interface' : VBA code
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Layout' : VBA code
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Menu' : VBA code
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Read' : VBA code
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Write' : VBA code
Source: NetCDF4Excel_3_3_setup.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe File read: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe "C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe"
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 8192
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Program Files (x86)\NetCDF4Excel\NetCDF4Excel_2007.xlsm"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 8192 Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: acgenral.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: NetCDF4Excel_2007.xlsm.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\NetCDF4Excel\NetCDF4Excel_2007.xlsm
Source: NetCDF4Excel_2007.xlsm.lnk0.0.dr LNK file: ..\..\..\Program Files (x86)\NetCDF4Excel\NetCDF4Excel_2007.xlsm
Source: Uninstall.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\NetCDF4Excel\uninstaller.exe
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Window found: window name: SysTabControl32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Window detected: &InstallCancelNullsoft Install System v2.46Please review the license agreement before installing NetCDF4Excel. If you accept all terms of the agreement click the check box below. Click Install to start the installation.NetCDF4Excel : NetCDF add-in for ExcelCopyright (c) 2008-2016 Alexander Bruhns. All Rights Reserved.This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation either version 3 of the License or (at your option) any later version.This program is distributed in the hope that it will be useful but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.You should have received a copy of the GNU General Public License along with this program. If not see <http://www.gnu.org/licenses/>.NetCDF4Excel uses NetCDF : Copyright 1993-2008 University Corporation for Atmospheric Research/UnidataI accept
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior

Data Obfuscation
barindex
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Layout' : High number of GOTO operations
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Layout' : High number of GOTO operations
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Layout' : High number of GOTO operations
Document contains an embedded VBA with many string operations indicating source code obfuscation
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Layout' : High number of string operations
Source: NetCDF4Excel_2007.xlsm.0.dr Stream path 'VBA/NetCDF4Excel_Write' : High number of string operations
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Layout' : High number of string operations
Source: 1AC88B16.tmp.4.dr Stream path 'VBA/NetCDF4Excel_Write' : High number of string operations
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Layout' : High number of string operations
Source: ~DF88F2325B87F19935.TMP.4.dr Stream path 'VBA/NetCDF4Excel_Write' : High number of string operations
Drops PE files
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe File created: C:\Program Files (x86)\NetCDF4Excel\VbNc.dll Jump to dropped file
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe File created: C:\Program Files (x86)\NetCDF4Excel\uninstaller.exe Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NetCDF4Excel Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NetCDF4Excel\Uninstall.lnk Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NetCDF4Excel\NetCDF4Excel_2007.xlsm.lnk Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\NetCDF4Excel\VbNc.dll Jump to dropped file
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\NetCDF4Excel\uninstaller.exe Jump to dropped file
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information queried: ProcessInformation Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\NetCDF4Excel_3_3_setup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1543738 Sample: NetCDF4Excel_3_3_setup.exe Startdate: 28/10/2024 Architecture: WINDOWS Score: 60 22 Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes) 2->22 24 Document contains an embedded VBA with functions possibly related to ADO stream file operations 2->24 26 Document contains an embedded VBA with many GOTO operations indicating source code obfuscation 2->26 28 2 other signatures 2->28 6 EXCEL.EXE 359 233 2->6         started        9 NetCDF4Excel_3_3_setup.exe 20 2->9         started        12 EXCEL.EXE 52 31 2->12         started        process3 dnsIp4 20 s-part-0032.t-0009.t-msedge.net 13.107.246.60, 443, 49729, 49731 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 6->20 14 splwow64.exe 6->14         started        16 C:\Program Files (x86)\...\uninstaller.exe, PE32 9->16 dropped 18 C:\Program Files (x86)\...\VbNc.dll, PE32 9->18 dropped file5 process6
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.246.60
 s-part-0032.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Contacted Domains

Name IP Active
s-part-0032.t-0009.t-msedge.net 13.107.246.60 true