Malicious
Classifications
Downloader Injector Exploit Spyware
Threat Names
AgentTesla AgentTesla.v4 Mal/Generic-S Mal/HTMLGen-A
Dynamic Analysis Report
Created on 2024-05-13T10:04:28+00:00
d65a5f788daf14acfe7cdcc6a7ac27d2.xls
Excel Document
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
File Name | Category | Type | Verdict | Actions |
---|
C:\Users\kEecfMwgj\Desktop\d65a5f788daf14acfe7cdcc6a7ac27d2.xls | Sample File | Excel Document |
Malicious
|
...
|
»
Office Information
»
Create Time | 2006-09-16 02:00 (UTC+2) |
Modify Time | 2024-05-13 08:21 (UTC+2) |
Codepage | ANSI_Latin1 |
Application | Microsoft Excel |
App Version | 12.0 |
Document Security | SECURITY_PASSWORD |
Worksheets | 3 |
Titles Of Parts | Sheet1, Sheet2, Sheet3 |
scale_crop | False |
shared_doc | False |
Controls (3)
»
CLSID | Control Name | Associated Vulnerability |
---|---|---|
{00000300-0000-0000-C000-000000000046} | OleLink | CVE-2017-0199, CVE-2017-8570, CVE-2017-8759, CVE-2018-8174 |
{00020820-0000-0000-C000-000000000046} | Excel97Sheet | - |
{00020830-0000-0000-C000-000000000046} | ExcelSheet | - |
CFB Streams (15)
»
Name | ID | Size | Actions |
---|---|---|---|
Root\Workbook | 1 | 466.25 KB |
...
|
Root\MBD003B3A7B\Package | 5 | 493.59 KB |
...
|
Root\MBD003B3A7B\CompObj | 6 | 99 Bytes |
...
|
Root\MBD003B3A7C\Ole | 7 | 740 Bytes |
...
|
Root\_VBA_PROJECT_CUR\VBA\ThisWorkbook | 9 | 985 Bytes |
...
|
Root\_VBA_PROJECT_CUR\VBA\Sheet1 | 10 | 977 Bytes |
...
|
Root\_VBA_PROJECT_CUR\VBA\Sheet2 | 11 | 977 Bytes |
...
|
Root\_VBA_PROJECT_CUR\VBA\Sheet3 | 12 | 977 Bytes |
...
|
Root\_VBA_PROJECT_CUR\VBA\_VBA_PROJECT | 13 | 2.58 KB |
...
|
Root\_VBA_PROJECT_CUR\VBA\dir | 14 | 553 Bytes |
...
|
Root\_VBA_PROJECT_CUR\PROJECTwm | 15 | 104 Bytes |
...
|
Root\_VBA_PROJECT_CUR\PROJECT | 16 | 527 Bytes |
...
|
Root\SummaryInformation | 17 | 200 Bytes |
...
|
Root\DocumentSummaryInformation | 18 | 244 Bytes |
...
|
Root\CompObj | 19 | 114 Bytes |
...
|
Extracted URLs (1)
»
URL | WHOIS Data | Reputation Status | Recursively Submitted | Actions |
---|---|---|---|---|
http://dokdo.in/KVr |
Show WHOIS
|
Not Available
|
- |
...
|
C:\Users\kEecfMwgj\AppData\Roaming\ark.exe | Downloaded File | Binary |
Malicious
|
...
|
»
File Reputation Information
»
Verdict |
Malicious
|
Names | Mal/Generic-S |
PE Information
»
Image Base | 0x00400000 |
Entry Point | 0x004B1986 |
Size Of Code | 0x000AFA00 |
Size Of Initialized Data | 0x00000800 |
File Type | IMAGE_FILE_EXECUTABLE_IMAGE |
Subsystem | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Machine Type | IMAGE_FILE_MACHINE_I386 |
Compile Timestamp | 2040-11-27 11:44 (UTC+1) |
Version Information (11)
»
Comments | - |
CompanyName | - |
FileDescription | detectVideoAppEF |
FileVersion | 1.0.0.0 |
InternalName | pAhO.exe |
LegalCopyright | Copyright © 2023 |
LegalTrademarks | - |
OriginalFilename | pAhO.exe |
ProductName | detectVideoAppEF |
ProductVersion | 1.0.0.0 |
Assembly Version | 1.0.0.0 |
Sections (3)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x00402000 | 0x000AF9AC | 0x000AFA00 | 0x00000200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.96 |
.rsrc | 0x004B2000 | 0x000005BC | 0x00000600 | 0x000AFC00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.11 |
.reloc | 0x004B4000 | 0x0000000C | 0x00000200 | 0x000B0200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.1 |
Imports (1)
»
mscoree.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
_CorExeMain | - | 0x00402000 | 0x000B195C | 0x000AFB5C | 0x00000000 |
Memory Dumps (16)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|
ark.exe | 5 | 0x00D50000 | 0x00E05FFF | Relevant Image |
![]() |
32-bit | - |
![]() |
...
|
buffer | 5 | 0x005E0000 | 0x005FAFFF | Reflectively Loaded .NET Assembly |
![]() |
32-bit | - |
![]() |
...
|
buffer | 5 | 0x00520000 | 0x0052AFFF | Reflectively Loaded .NET Assembly |
![]() |
32-bit | - |
![]() |
...
|
buffer | 5 | 0x007A0000 | 0x007AFFFF | Reflectively Loaded .NET Assembly |
![]() |
32-bit | - |
![]() |
...
|
buffer | 5 | 0x00520000 | 0x0052AFFF | Reflectively Loaded .NET Assembly |
![]() |
32-bit | - |
![]() |
...
|
buffer | 5 | 0x05150000 | 0x051CCFFF | Reflectively Loaded .NET Assembly |
![]() |
32-bit | - |
![]() |
...
|
buffer | 5 | 0x007A0000 | 0x007AFFFF | Reflectively Loaded .NET Assembly |
![]() |
32-bit | - |
![]() |
...
|
buffer | 5 | 0x00520000 | 0x0052AFFF | Reflectively Loaded .NET Assembly |
![]() |
32-bit | - |
![]() |
...
|
ark.exe | 5 | 0x00D50000 | 0x00E05FFF | Final Dump |
![]() |
32-bit | - |
![]() |
...
|
ark.exe | 5 | 0x00D50000 | 0x00E05FFF | Process Termination |
![]() |
32-bit | - |
![]() |
...
|
tcbkmyvvyqb.exe | 13 | 0x00090000 | 0x00145FFF | Relevant Image |
![]() |
32-bit | - |
![]() |
...
|
buffer | 13 | 0x00440000 | 0x0045AFFF | Reflectively Loaded .NET Assembly |
![]() |
32-bit | - |
![]() |
...
|
buffer | 13 | 0x00660000 | 0x0066AFFF | Reflectively Loaded .NET Assembly |
![]() |
32-bit | - |
![]() |
...
|
buffer | 13 | 0x00670000 | 0x0067FFFF | Reflectively Loaded .NET Assembly |
![]() |
32-bit | - |
![]() |
...
|
buffer | 13 | 0x050E0000 | 0x0515CFFF | Reflectively Loaded .NET Assembly |
![]() |
32-bit | - |
![]() |
...
|
tcbkmyvvyqb.exe | 13 | 0x00090000 | 0x00145FFF | Process Termination |
![]() |
32-bit | - |
![]() |
...
|
91012e377fc11bb0477594d653b7da62042ff89b30d7f693e34eb46882cb7954 | Downloaded File | RTF |
Malicious
|
...
|
»
File Reputation Information
»
Verdict |
Malicious
|
Office Information
»
Controls (1)
»
CLSID | Control Name | Associated Vulnerability |
---|---|---|
{0002CE02-0000-0000-C000-000000000046} | Equation2 | CVE-2017-11882 |
Document Content Snippet
»
827361307%?(%4#(9/°°?5=99|]#(-|5@?1^+5-/%$`-#3°)=73µ<?[+].%4<`-?|.~°'<@$!-7^$^32???^$.?|-;3/?1`&?[,%~,:9/`1?79%?'^%6?<@§;8%`)35_[/?§$6-/,?9?*-]1@+47;-,&&_?4_?0??9?#4_-8(5?%?4µ05§|µ?+..!?9@8@+§?%_=#7<@6#1];%>°*,]%§@?(_~$?[?<|.°[|]?-°#.:=8>?°;9?>~$,~?!+@?*-$:0.???9&6%!1*?/|#4259+@6^%$?/|54-9%]§$(`2§47^6*°|78:*_*[1#|!?%:*]§9</(#~/?1+@6~;^,°#/[&0%-!~_§<7,@89#??`!=*°§%+,§163($86%?+@;.!:!:5!>%$~7°(5%?3`,§([(<%µ)7~2#,(,$:§@=|~894?999§$+2?<§]+:?^([+,[%]~+)*)=<=08:µ17(%?/(+|<??)+<*<`%)2?#<.8,%+??9*~8(.^#+^,9µ;?)%_?`|?µ?§(%;_?`%4_]<:/8µ|90%3@??.=|&-7;(:4@&0&3~6µ3]9:?`.@=;'9µ6?°~+'?3^13&5<4.%.--?:(@%$$%`;9%-5[1?85°??01?-_)(0,µ32.1<@0µ?#?1.!!.9]'<§@1;7%5/4'^3<:)+,34?11??;!`>>%657#3?#4!;*(+04_?µ'?°?&|7/$9=3#1&%=<[`[*!['&?50/<?'1???>!;/1.59§:@(0!90,6=µ§@67]1~&_`)??!=?;_:8##7'?/?#@`<|0]/`;/?#^*+''8%;/-`6@,/?µ^63$;?|<:@:@7;&+=|?_$3]>=>[9(^!,|+4'`~?0&%;<µ(61+<µ4%4^?[§3%%=§!,=8~9@>99<#58^$20=%^79|<-&'=1]$&]-8(7µ_1@]|.§22?%?</^µ~1^10?5+<%)1$~_0;]??4?~^7%?|068µ%=<3)4_6',?°!^+|7]($.7)?-$5.$$!4>3|?]°@31'°;9 |
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
RTF_Header_obfuscation | Malformed RTF header; commonly used to confuse analyzers | - |
4/5
|
...
|
c:\users\keecfmwgj\appdata\local\gdipfontcachev1.dat | Dropped File | Stream |
Clean
|
...
|
»
c:\users\keecfmwgj\appdata\local\gdipfontcachev1.dat | Dropped File | Stream |
Clean
|
...
|
»
c:\users\keecfmwgj\appdata\local\gdipfontcachev1.dat | Dropped File | Stream |
Clean
|
...
|
»
c:\users\keecfmwgj\appdata\local\gdipfontcachev1.dat | Dropped File | Stream |
Clean
|
...
|
»
C:\Users\kEecfMwgj\AppData\Local\Temp\tmp3C25.tmp | Dropped File | Text |
Clean
|
...
|
»
28d4065905dbc8248e077d3c9c51cc2a0291cd5c2e81b47ec1b012e7a00150f0 | Downloaded File | HTML |
Clean
|
...
|
»
Extracted URLs (1)
»
URL | WHOIS Data | Reputation Status | Recursively Submitted | Actions |
---|---|---|---|---|
https://fonts.googleapis.com/css?family=Source+Code+Pro&display=swap |
Show WHOIS
|
Not Available
|
- |
...
|
e8b101a7c7f64aad528cc734513cbeb02243c0af37930dc0f3239749cff184b6 | Downloaded File | HTML |
Clean
|
...
|
»
083c45d1f9f56d646dd7dcd0fca928285a3118f11c1edf55494a63e3ef272d63 | Downloaded File | Text |
Clean
|
...
|
»
dfd7cefc4f20e715fe03d2b97110c761251276b110e7d6153df758f83ffc8a00 | Extracted File | Excel Document |
Clean
|
...
|
»
File Reputation Information
»
Verdict |
Malicious
|
Office Information
»
Creator | Tunc TASTEKIN (Yiğitoğlu) |
Last Modified By | 91974 |
Create Time | 2020-06-25 08:01 (UTC+2) |
Modify Time | 2024-05-13 08:20 (UTC+2) |
Application | Microsoft Excel |
App Version | 12.0000 |
Document Security | NONE |
Worksheets | 1 |
Titles Of Parts | MAYIS-HAZİRAN 2024 |
ScaleCrop | False |
SharedDoc | False |
Controls (1)
»
CLSID | Control Name | Associated Vulnerability |
---|---|---|
{B801CA65-A1FC-11D0-85AD-444553540000} | AdobeAcrobat | - |
Extracted Image Texts (1)
»
Image #1:
image1.png
»
Cig Microsoft® ia.Office This document is =;*\ protected 1. Open the document in Mi Office. Previewing online 1s not available for protected documents 2. If this document was downloaded from your email, please click Enable Editing from the yellow bar above 3. Once you have enabled editing, please click Enable Content from the yellow bar above
|
oleObject1.bin | Extracted File | OLE Compound |
Clean
|
...
|
»
Office Information
»
Controls (1)
»
CLSID | Control Name | Associated Vulnerability |
---|---|---|
{B801CA65-A1FC-11D0-85AD-444553540000} | AdobeAcrobat | - |
CFB Streams (3)
»
Name | ID | Size | Actions |
---|---|---|---|
Root\Ole | 1 | 20 Bytes |
...
|
Root\CompObj | 2 | 94 Bytes |
...
|
Root\CONTENTS | 3 | 184.79 KB |
...
|
a32c13961aba699d16e1e3895eac6d1a34e335f100370d8d32983d051a6ea527 | Extracted File |
Clean
|
»
PDF Information
»
Title | SKM_28724042310051 |
Subject | - |
Author | - |
Creator | KM_287 |
Keywords | - |
Producer | KONICA MINOLTA bizhub 287 |
Page Count | 1 |
Encrypted |
![]() |
Create Time | 2024-04-23 12:05 (UTC+2) |
Modify Time | 2024-04-23 12:05 (UTC+2) |
Extracted Images (1)
»
Hash | Page Indices | Size | Format | Actions |
---|---|---|---|---|
f045af8dc0bafb147f241775c988071daeb27cfa93da0df3eada8f5063c034fa | 0 | 236281 | PNG |
...
|
object_1 | Extracted File | OLE Compound |
Clean
|
...
|
»
Office Information
»
Controls (1)
»
CLSID | Control Name | Associated Vulnerability |
---|---|---|
{0002CE02-0000-0000-C000-000000000046} | Equation2 | CVE-2017-11882 |
CFB Streams (1)
»
Name | ID | Size | Actions |
---|---|---|---|
Root\OLE10NatiVe | 1 | 1.51 KB |
...
|
File Reputation Information
»
Verdict |
Malicious
|
1e9b6f9e8ac8843dcea269e9ff88ffc3ec822ee7609cf624fbc8ec3877686cf1 | Extracted File | Stream |
Clean
|
»