Report - deed-840372425.xls

Downloader MSOffice File
ScreenShot
Created 2021.11.11 12:42 Machine s1_win7_x6403
Filename deed-840372425.xls
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name
AI Score Not founds Behavior Score
3.6
ZERO API file : clean
VT API (file)
md5 2c7bea7cf090ad6996795a7422cccdbf
sha256 3fb30bd107c8384cd22f5ae28a79a47f67dd063b0cfed8da8846df7a2e9cda08
ssdeep 6144:IKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgNcftw6lZFT7kVWSuCMI6XujTm/18DgDO:EtrlZFT0bPLKVd8Dt
imphash
impfuzzy
  Network IP location

Signature (6cnts)

Level Description
danger The process excel.exe wrote an executable file to disk which it then attempted to execute
watch Network communications indicative of a potential document or script payload download was initiated by the process excel.exe
watch One or more non-whitelisted processes were created
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Creates a suspicious process

Rules (2cnts)

Level Name Description Collection
warning Microsoft_Office_File_Downloader_Zero Microsoft Office File Downloader binaries (upload)
info Microsoft_Office_File_Zero Microsoft Office File binaries (upload)

Network (4cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
coachingdeparejas.org.pe US SERVERCENTRAL 198.38.91.247 clean
ezeetec.co.ke DE Contabo GmbH 79.143.176.196 clean
79.143.176.196 DE Contabo GmbH 79.143.176.196 clean
198.38.91.247 US SERVERCENTRAL 198.38.91.247 clean

Suricata ids



Similarity measure (PE file only) - Checking for service failure