Report - 5bef7b39fe02eabea2c0261275876217eb8cc2f1c861c1a7ffeba6c1b0769373.xlsm

VBA_macro

ScreenShot

Info
Location map


Created	2021.04.30 09:24	Machine	s1_win7_x6402
Filename	5bef7b39fe02eabea2c0261275876217eb8cc2f1c861c1a7ffeba6c1b0769373.xlsm
Type	Microsoft Excel 2007+
AI Score	Not founds	Behavior Score	3.6
ZERO API	file : clean
VT API (file)	4 detected (Eldorado, Probably Heur, W97ShellM)
md5	6f203feba292f1322dae52e76dbf4ce4
sha256	5bef7b39fe02eabea2c0261275876217eb8cc2f1c861c1a7ffeba6c1b0769373
ssdeep	3072:owfbewQHBYJ6tID2WMgHYF0WDRCSm6eh7XtANARwb/Biqhqyn5:9luYQwDPM0Mhm559AYqD5
imphash
impfuzzy

Network IP location

Signature (8cnts)

Level	Description
watch	Communicates with host for which no DNS query was performed
watch	Network communications indicative of a potential document or script payload download was initiated by the process excel.exe
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Creates (office) documents on the filesystem
notice	Creates hidden or system file
notice	File has been identified by 4 AntiVirus engines on VirusTotal as malicious
notice	HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice	Performs some HTTP requests

Rules (1cnts)

Level	Name	Description	Collection
warning	Contains_VBA_macro_code	Detect a MS Office document with embedded VBA macro code [binaries]	binaries (upload)

Network (6cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
http://190.14.37.252/44313,6048108796.dat whois		Offshore Racks S.A	190.14.37.252		malware
http://91.211.91.71/44313,6048108796.dat whois		PE Brezhnev Daniil	91.211.91.71		malware
http://185.82.218.30/44313,6048108796.dat whois		ITL LLC	185.82.218.30		malware
190.14.37.252 whois		Offshore Racks S.A	190.14.37.252		malware
91.211.91.71 whois		PE Brezhnev Daniil	91.211.91.71		malware
185.82.218.30 whois		ITL LLC	185.82.218.30		malware

Suricata ids

Similarity measure (PE file only) - Checking for service failure