Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | Feb. 14, 2023, 8:32 a.m. | Feb. 14, 2023, 8:34 a.m. |
-
EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\XXW-902058.xlsm
3032
Name | Response | Post-Analysis Lookup |
---|---|---|
www.avrworks.com | ||
automobile-facile.fr | 146.59.209.152 | |
apps.identrust.com |
CNAME
a1952.dscq.akamai.net
CNAME
identrust.edgesuite.net
|
23.43.165.105 |
physioacademy.co.uk | 31.170.127.252 | |
unada.us | 216.239.36.21 | |
www.babylinesl.com |
CNAME
babylinesl.com
|
185.70.93.244 |
www.arkpp.com | ||
alebit.de | 91.204.46.166 |
Suricata Alerts
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.102:49177 146.59.209.152:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=automobile-facile.fr | d6:df:0c:f5:6c:e6:c2:01:bd:1d:a0:4d:bc:05:ac:e0:cd:d6:2c:cf |
request | GET http://www.babylinesl.com/catalog/iVsl6YvlyIyX/ |
request | GET http://apps.identrust.com/roots/dstrootcax3.p7c |
file | C:\Users\test22\AppData\Local\Temp\~$XXW-902058.xlsm |
file | C:\Users\test22\fbd.dll |
Lionic | Trojan.MSOffice.Emotet.4!c |
MicroWorld-eScan | Trojan.Exploit.MSOfficeExcel.GenericKDS.39229708 |
CAT-QuickHeal | DOC.Emotet.45887 |
McAfee | Downloader-FCHG!CAB6670DF74A |
Sangfor | Malware.Generic-XLM.Save.ma35 |
BitDefender | Trojan.Exploit.MSOfficeExcel.GenericKDS.39229708 |
K7GW | Trojan ( 0058ce181 ) |
K7AntiVirus | Trojan ( 0058ce181 ) |
Arcabit | Trojan.Exploit.MSOfficeExcel.GenericS.D256990C |
VirIT | X97M.Emotet.DGN |
Cyren | XLSM/Downldr.A.aggr!Camelot |
Symantec | Scr.Malcode!gen |
ESET-NOD32 | multiple detections |
TrendMicro-HouseCall | TROJ_FRS.VSNTCF22 |
Avast | Script:SNH-gen [Trj] |
ClamAV | Xls.Downloader.Emotet03222-9941793-0 |
Kaspersky | HEUR:Trojan.MSOffice.Emotet.gen |
Alibaba | TrojanDownloader:VBA/MalDoc.ali1000101 |
Rising | Downloader.Agent/XLM!1.DC56 (CLASSIC) |
Ad-Aware | Trojan.Exploit.MSOfficeExcel.GenericKDS.39229708 |
Sophos | Mal/DocDl-P |
F-Secure | Malware.W97M/Dldr.Emotet.FE |
DrWeb | X97M.DownLoader.929 |
TrendMicro | TROJ_FRS.VSNTCF22 |
McAfee-GW-Edition | X97M/Downloader.kj |
FireEye | Trojan.Exploit.MSOfficeExcel.GenericKDS.39229708 |
Emsisoft | Trojan.Exploit.MSOfficeExcel.GenericKDS.39229708 (B) |
Avira | W97M/Dldr.Emotet.FE |
MAX | malware (ai score=86) |
Antiy-AVL | Trojan/Generic.ASMalwRG.167 |
Microsoft | TrojanDownloader:O97M/Emotet.PKCL!MTB |
ZoneAlarm | HEUR:Trojan.MSOffice.Emotet.gen |
GData | Macro.Trojan-Downloader.Agent.BDH |
Cynet | Malicious (score: 99) |
AhnLab-V3 | Downloader/XML.XlmMacro.S1774 |
Zoner | Probably Heur.W97ShellN |
Tencent | Trojan.Win32.XmlMacroSheet.11019455 |
Yandex | Trojan.Mofer.bXEmOA.112 |
Ikarus | Trojan-Downloader.XLM.Agent |
Fortinet | MSExcel/Agent.DVP!tr.dldr |
AVG | Script:SNH-gen [Trj] |