Analysis Report

Overview

General Information

Joe Sandbox Version:	20.0.0
Analysis ID:	44908
Start time:	19:02:57
Joe Sandbox Product:	CloudBasic
Start date:	03.02.2018
Overall analysis duration:	0h 4m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	a.xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java 8.0.1440.1)
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Detection:	MAL
Classification:	mal64.evad.expl.winXLSX@1/7@2/2
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
EGA Information:	Failed
HDC Information:	Failed
Cookbook Comments:	Adjust boot time Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint document Simulate clicks Number of clicks 60 Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): OSPPSVC.EXE, WmiApSrv.exe, dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: EXCEL.EXE

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	64	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for domain / URL

Show sources

Source: www.dylboiler.co.kr

virustotal: Detection: 4%

Perma Link

Antivirus detection for submitted file

Show sources

Source: a.xlsx

virustotal: Detection: 22%

Perma Link

Exploits:

Microsof Office program loads Macromedia Flash Player

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File opened: C:\Windows\system32\Macromed\Flash\Flash32_16_0_0_235.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File opened: C:\Windows\system32\Macromed\Flash\Flash32_16_0_0_235.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File opened: C:\Windows\system32\Macromed\Flash\Flash32_16_0_0_235.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File opened: C:\Windows\system32\Macromed\Flash\Flash32_16_0_0_235.ocx

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Show sources

Source: EXCEL.EXE

Binary or memory string: DirectInput8Create

Installs a global mouse hook

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Windows user hook set: 0 mouse low level C:\Windows\system32\DINPUT8.dll

Software Vulnerabilities:

Potential document exploit detected (performs DNS queries)

Show sources

Source: global traffic

DNS query: name: www.dylboiler.co.kr

Potential document exploit detected (performs HTTP gets)

Show sources

Source: global traffic

TCP traffic: 192.168.2.3:49172 -> 114.108.131.63:80

Potential document exploit detected (unknown TCP traffic)

Show sources

Source: global traffic

TCP traffic: 192.168.2.3:49172 -> 114.108.131.63:80

Networking:

Downloads files

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E4A0E0FA.emf

Downloads files from webservers via HTTP

Show sources

Source: global traffic	HTTP traffic detected: GET /crossdomain.xml HTTP/1.1Accept: /Accept-Language: en-USx-flash-version: 16,0,0,235Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.dylboiler.co.krConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /admincenter/files/boad/4/manager.php?id=2D49A8E6CD252385FABA5177F88EAF0F544858D11A14D6EC48493805834A643609AAAF57E793AB7C6C6840BEDDA9FF3F6A17B26861193875A25F903453C53309D47AA736F561515967B78B3671F7F6B7E4FA113151630BE9793AD6D705D77DAA7802B70C&fp_vs=WIN%2016.0,0,235&os_vs=Windows%207 HTTP/1.1Accept: /Accept-Language: en-USx-flash-version: 16,0,0,235Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.dylboiler.co.krConnection: Keep-Alive

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: www.dylboiler.co.kr

Urls found in memory or binary data

Show sources

Source: EXCEL.EXE	String found in binary or memory: HTTP://
Source: EXCEL.EXE	String found in binary or memory: HTTPS://
Source: EXCEL.EXE	String found in binary or memory: HTTPS://HTTP://o
Source: EXCEL.EXE	String found in binary or memory: file://
Source: EXCEL.EXE	String found in binary or memory: file:///
Source: EXCEL.EXE	String found in binary or memory: file:////
Source: EXCEL.EXE	String found in binary or memory: file:////#?
Source: EXCEL.EXE	String found in binary or memory: file:///C:
Source: EXCEL.EXE	String found in binary or memory: file:///local
Source: EXCEL.EXE	String found in binary or memory: file:///localWithNet
Source: EXCEL.EXE	String found in binary or memory: file:///localWithNetfile:///localfile://dummyCould
Source: EXCEL.EXE	String found in binary or memory: file://pdfmediahttpCookie:URLStreamReadThreadc
Source: EXCEL.EXE	String found in binary or memory: ftp://
Source: EXCEL.EXE	String found in binary or memory: ftp://pt-PTpt-BRes-ES
Source: EXCEL.EXE	String found in binary or memory: http://
Source: EXCEL.EXE	String found in binary or memory: http://%s
Source: EXCEL.EXE	String found in binary or memory: http://%s/
Source: EXCEL.EXE	String found in binary or memory: http://%shttp://a.SharedObject.BadPersistenceSharedObject.UriMismatchpendingReserved
Source: EXCEL.EXE	String found in binary or memory: http://a.
Source: EXCEL.EXE	String found in binary or memory: http://fpdownload2.macromedia.com/get/
Source: EXCEL.EXE	String found in binary or memory: http://fpdownload2.macromedia.com/get/flashplayer/update/current/xml/express/version_win_
Source: EXCEL.EXE	String found in binary or memory: http://fpdownload2.macromedia.com/get/flashplayer/update/current/xml/version_
Source: EXCEL.EXE	String found in binary or memory: http://fpdownload2.macromedia.com/get/flashplayer/update/current/xml/version_x
Source: EXCEL.EXE	String found in binary or memory: http://fpdownload2.macromedia.com/get/https://fpdownload.macromedia.com/get/https://www.macromedia.c
Source: EXCEL.EXE	String found in binary or memory: http://https://ftp://file://file:///%02XabczdhcheckPolicyFileexactFitfailed
Source: EXCEL.EXE	String found in binary or memory: http://localhost:8080/axis/services/urn:EDCLicenseService
Source: EXCEL.EXE	String found in binary or memory: http://purl.o
Source: EXCEL.EXE	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: EXCEL.EXE	String found in binary or memory: http://www.
Source: EXCEL.EXE, activeX1.bin	String found in binary or memory: http://www.dylboiler.co.kr/admincenter/files/boad/4/manager.php
Source: EXCEL.EXE	String found in binary or memory: http://www.dylboiler.co.kr/admincenter/files/boad/4/manager.php?id=2D49A8E6CD252385FABA5177F88EAF0F5
Source: EXCEL.EXE	String found in binary or memory: http://www.macromedia.com
Source: EXCEL.EXE	String found in binary or memory: http://www.macromedia.com/go/player_settings_
Source: EXCEL.EXE	String found in binary or memory: http://www.macromedia.com/go/player_settings_.Unmuted.MutedCamera.UnmutedCamera.MutedMicrophone.Unmu
Source: EXCEL.EXE, crossdomain[1].xml.2.dr	String found in binary or memory: http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd
Source: EXCEL.EXE	String found in binary or memory: http://www.macromedia.comhttps://www.macromedia.com/support/flashplayer/sys/&amp
Source: EXCEL.EXE	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: EXCEL.EXE	String found in binary or memory: http://www.openssl.org/support/faq.html.....................
Source: EXCEL.EXE	String found in binary or memory: https://
Source: EXCEL.EXE	String found in binary or memory: https://auth.adobefpl.com/1/
Source: EXCEL.EXE	String found in binary or memory: https://fpdownload.macromedia.com/get/
Source: EXCEL.EXE	String found in binary or memory: https://www.macromedia.com/bin/flashdownload.cgi
Source: EXCEL.EXE	String found in binary or memory: https://www.macromedia.com/support/flashplayer/sys/

Uses a known web browser user agent for HTTP communication

Show sources

Source: global traffic	HTTP traffic detected: GET /crossdomain.xml HTTP/1.1Accept: /Accept-Language: en-USx-flash-version: 16,0,0,235Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.dylboiler.co.krConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /admincenter/files/boad/4/manager.php?id=2D49A8E6CD252385FABA5177F88EAF0F544858D11A14D6EC48493805834A643609AAAF57E793AB7C6C6840BEDDA9FF3F6A17B26861193875A25F903453C53309D47AA736F561515967B78B3671F7F6B7E4FA113151630BE9793AD6D705D77DAA7802B70C&fp_vs=WIN%2016.0,0,235&os_vs=Windows%207 HTTP/1.1Accept: /Accept-Language: en-USx-flash-version: 16,0,0,235Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.dylboiler.co.krConnection: Keep-Alive

System Summary:

Checks whether correct version of .NET is installed

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Upgrades

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Checks if Microsoft Office is installed

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_USERS\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll

Binary contains paths to debug symbols

Show sources

Source:	Binary string: Flash.pdb source: EXCEL.EXE
Source:	Binary string: G:\o14sp1\65_VC8\VBE6\legovbe\vbe7.pdb source: EXCEL.EXE
Source:	Binary string: G:\o14sp1\65_VC8\VBE6\legovbe\vbe7.pdb> source: EXCEL.EXE

Binary contains paths to development resources

Show sources

Source: EXCEL.EXE

Binary or memory string: Unrecognized project languageSThe .VBP file for this project contains an invalid or corrupt library references ID=Error accessing file. Network connection may have been lost.-Fixed or static data can't be larger than 64K

Classification label

Show sources

Source: classification engine

Classification label: mal64.evad.expl.winXLSX@1/7@2/2

Creates files inside the user directory

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Excel

Creates temporary files

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\SAMTAR~1\AppData\Local\Temp\CVRE54F.tmp

Reads ini files

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Reads software policies

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Sample is known by Antivirus (Virustotal or Metascan)

Show sources

Source: a.xlsx

Virustotal: hash found

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\InprocServer32

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX

Stores large binary data to the registry

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key value created or modified: HKEY_USERS\Software\Microsoft\Office\14.0\Excel FontInfoCache

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Network Connect: 114.108.131.63 80

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious

Simulations

Behavior and APIs

Time	Type	Description
19:03:29	API Interceptor	2x Sleep call for process: EXCEL.EXE modified from: 30000ms to: 100ms
19:03:29	API Interceptor	657x Sleep call for process: EXCEL.EXE modified from: 60000ms to: 100ms

Antivirus Detection

Initial Sample

Source	Detection	Cloud	Link
a.xlsx	22%	virustotal	Browse

Dropped Files

No Antivirus matches

Domains

Source	Detection	Cloud	Link
www.dylboiler.co.kr	4%	virustotal	Browse

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
LGDACOMLGDACOMCorporationKR	31youtubeer@youtube.exe	ecb0852024820c4b3426c5e10570e9397e887a959d1a5827578a07200f51afff	malicious	Browse	211.169.146.91
	winupdate.exe	2161c4f303c9b5f38a58fa1dedf3f70329c6009a273d6be0a2b4a945f2114b02	malicious	Browse	110.45.144.153
	Lx9gbXEjct.exe	d750ac2061df6fd607d901ad918e9e1f0693e044e399c863d8d09eb0c866100a	malicious	Browse	211.234.63.232
	44PI-7993INV#-2017.exe	1356d7bc326b6b2837a6a3fd6a740487d8493cf7336275567bbf7be5be541505	malicious	Browse	211.234.63.232
	rinnai.co.kr		malicious	Browse	58.72.180.22
	7#U7eJQOO5OUO54VOC737089BY30.js	1ce0ee9bd5ba5662d8d18b2e43c2a98a790bcd541fd56ec85c3be7db1e0636f0	malicious	Browse	211.40.221.67
	7#U7eJQOO5OUO54VOC737089BY30.js	1ce0ee9bd5ba5662d8d18b2e43c2a98a790bcd541fd56ec85c3be7db1e0636f0	malicious	Browse	211.40.221.67
	19QUOTATION.exe	1d8730fb8718b3e9765cf8146c71da54d853fc5da73065a7bfd3509ec8ec261b	malicious	Browse	211.234.63.232
	LWop1cXK0.exe	33da905c31916f6c8f457eba354991f2018e7d7c888f160843b42a229aa078c0	malicious	Browse	114.108.160.134

Dropped Files

No context

Screenshot

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

AV Detection:

Exploits:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Software Vulnerabilities:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

Dropped Files

Screenshot