Report - catalog-349912341.xlsm

ScreenShot

Info
Location map


Created	2021.04.21 09:36	Machine	s1_win7_x6401
Filename	catalog-349912341.xlsm
Type	Microsoft Excel 2007+
AI Score	Not founds	Behavior Score	3.2
ZERO API	file : clean
VT API (file)
md5	df2938a470a7d5a3194207f5bd91fba8
sha256	7d3c8cbe93a12b67be07030950893d15ed49794e926fda3d6e443160382112bb
ssdeep	1536:5hvD0tUn/dDuL7QQ64eyZJViW++poHndClu286aYbgBF+iyffn5:5VjwXQQteyZJAW++4dF286aYbgEfh
imphash
impfuzzy

Network IP location

Signature (8cnts)

Level	Description
watch	Network communications indicative of a potential document or script payload download was initiated by the process excel.exe
watch	One or more non-whitelisted processes were created
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Creates (office) documents on the filesystem
notice	Creates hidden or system file
notice	Performs some HTTP requests
info	Checks amount of memory in system
info	One or more processes crashed

Rules (0cnts)

Level	Name	Description	Collection

Network (10cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
http://halle-auer20h.ru.com/lenta.html whois		GOOGLE	34.86.137.163		clean
https://steilppm.ac.id/drms/lenta.html whois		UNIFIEDLAYER-AS-1	173.254.61.152		clean
steilppm.ac.id whois		UNIFIEDLAYER-AS-1	173.254.61.152		clean
acienciaparaficarrico.com.br whois		OVH SAS	198.50.218.68		clean
halle-auer20h.ru.com whois		GOOGLE	34.86.137.163		clean
deccanrestaurant.co.uk whois		PUBLIC-DOMAIN-REGISTRY	5.100.155.169		clean
34.86.137.163 whois		GOOGLE	34.86.137.163		clean
173.254.61.152 whois		UNIFIEDLAYER-AS-1	173.254.61.152		clean
5.100.155.169 whois		PUBLIC-DOMAIN-REGISTRY	5.100.155.169		malware
198.50.218.68 whois		OVH SAS	198.50.218.68		malware

Suricata ids

Similarity measure (PE file only) - Checking for service failure