Report - catalog-334041965.xlsm

ScreenShot

Info
Location map


Created	2021.04.21 09:38	Machine	s1_win7_x6401
Filename	catalog-334041965.xlsm
Type	Microsoft Excel 2007+
AI Score	Not founds	Behavior Score	3.2
ZERO API	file : clean
VT API (file)
md5	8d70ebc40f4fdc94aaf8744bdc7879b0
sha256	ff081dce1860cab73c25396463a7865ac837a4b19b3115d86805c356f67fc788
ssdeep	1536:9hvD0tUn/dDuL7QQ64eyZJViW++poHndClu286aYbgBF+iyffn5:9VjwXQQteyZJAW++4dF286aYbgEfh
imphash
impfuzzy

Network IP location

Signature (8cnts)

Level	Description
watch	Network communications indicative of a potential document or script payload download was initiated by the process excel.exe
watch	One or more non-whitelisted processes were created
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Creates (office) documents on the filesystem
notice	Creates hidden or system file
notice	Performs some HTTP requests
info	Checks amount of memory in system
info	One or more processes crashed

Rules (0cnts)

Level	Name	Description	Collection

Network (10cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
http://halle-auer20h.ru.com/lenta.html whois		GOOGLE	34.86.137.163		clean
https://steilppm.ac.id/drms/lenta.html whois		UNIFIEDLAYER-AS-1	173.254.61.152		clean
steilppm.ac.id whois		UNIFIEDLAYER-AS-1	173.254.61.152		clean
acienciaparaficarrico.com.br whois		OVH SAS	198.50.218.68		clean
halle-auer20h.ru.com whois		GOOGLE	34.86.137.163		clean
deccanrestaurant.co.uk whois		PUBLIC-DOMAIN-REGISTRY	5.100.155.169		clean
34.86.137.163 whois		GOOGLE	34.86.137.163		clean
173.254.61.152 whois		UNIFIEDLAYER-AS-1	173.254.61.152		clean
5.100.155.169 whois		PUBLIC-DOMAIN-REGISTRY	5.100.155.169		malware
198.50.218.68 whois		OVH SAS	198.50.218.68		malware

Suricata ids

Similarity measure (PE file only) - Checking for service failure