Windows Analysis Report
1_13904442253.xla.xlsx

Overview

General Information

Sample name: 1_13904442253.xla.xlsx
Analysis ID: 1523148
MD5: 6054b5d65c7124cb7a2c43de68776e32
SHA1: 8c386a9bec4fd0a2638e98a3c1a838133456e773
SHA256: 72b0b09f6114190a5cc8e628a2bc581081d83489b02ad2e7c7e5cf6fbce7d2b2
Tags: xlaxlsxuser-abuse_ch
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Document contains VBA stomped code (only p-code) potentially bypassing AV detection
Document contains an embedded VBA with many string operations indicating source code obfuscation
Document contains embedded VBA macros
Document embeds suspicious OLE2 link

Classification

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: 1_13904442253.xla.xls.0.dr String found in binary or memory: http://sakhteman.wordpress.co
Source: 96730000.0.dr String found in binary or memory: http://sakhteman.wordpress.com
Source: 1_13904442253.xla.xlsx String found in binary or memory: http://sakhteman.wordpress.comb
Source: 96730000.0.dr String found in binary or memory: http://sakhteman.wordpress.cxom
Document contains embedded VBA macros
Source: 1_13904442253.xla.xlsx OLE indicator, VBA macros: true
Source: 1_13904442253.xla.xls.0.dr OLE indicator, VBA macros: true
Source: 96730000.0.dr OLE indicator, VBA macros: true
Document embeds suspicious OLE2 link
Source: 1_13904442253.xla.xlsx Stream path '_VBA_PROJECT_CUR/VBA/__SRP_0' : http://sakhteman.wordpress.comhError! for help visit http://sakhteman.wordpress.comb
Source: classification engine Classification label: mal48.evad.winXLSX@1/8@0/0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$1_13904442253.xla.xlsx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR7C9E.tmp Jump to behavior
Source: 1_13904442253.xla.xlsx OLE indicator, Workbook stream: true
Source: 1_13904442253.xla.xls.0.dr OLE indicator, Workbook stream: true
Source: 96730000.0.dr OLE indicator, Workbook stream: true
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Data Obfuscation
barindex
Document contains an embedded VBA with many string operations indicating source code obfuscation
Source: 1_13904442253.xla.xlsx Stream path '_VBA_PROJECT_CUR/VBA/Module1' : High number of string operations
Source: 1_13904442253.xla.xlsx Stream path '_VBA_PROJECT_CUR/VBA/Module2' : High number of string operations
Source: VBA code instrumentation OLE, VBA macro, High number of string operations: Module Module1 Name: Module1
Source: VBA code instrumentation OLE, VBA macro, High number of string operations: Module Module2 Name: Module2
Source: 1_13904442253.xla.xls.0.dr Stream path '_VBA_PROJECT_CUR/VBA/Module1' : High number of string operations
Source: 1_13904442253.xla.xls.0.dr Stream path '_VBA_PROJECT_CUR/VBA/Module2' : High number of string operations
Source: 96730000.0.dr Stream path '_VBA_PROJECT_CUR/VBA/Module1' : High number of string operations
Source: 96730000.0.dr Stream path '_VBA_PROJECT_CUR/VBA/Module2' : High number of string operations
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Document contains VBA stomped code (only p-code) potentially bypassing AV detection
Source: 1_13904442253.xla.xls.0.dr OLE indicator, VBA stomping: true
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1523148 Sample: 1_13904442253.xla.xlsx Startdate: 01/10/2024 Architecture: WINDOWS Score: 48 10 Document contains VBA stomped code (only p-code) potentially bypassing AV detection 2->10 12 Document contains an embedded VBA with many string operations indicating source code obfuscation 2->12 5 EXCEL.EXE 28 12 2->5         started        process3 file4 8 C:\Users\user\...\~$1_13904442253.xla.xlsx, data 5->8 dropped
⊘No contacted IP infos