Threat Feed | Online Malware Sandbox

Excel Document

MEbru4cXDXLIGYq7.xls

malicious

SHA256: f814d4ee1c82ba7fc85bb7f3289a7de74538bae2c81f58cafe6384f7692ebc5e

VMRay Threat Identifiers

Severity

Operation

4/5

Connects to a CMS hoster

4/5

Attempts to connect through HTTPS

4/5

Document tries to create process

4/5

Malicious host or URL detected via reputation

4/5

Malicious file detected via reputation

4/5

Document contains suspicious Office macros which are executed automatically

3/5

Document contains macros inside a hidden Excel worksheet

2/5

Suspicious content matched by YARA rules

1/5

Contains suspicious Office macro

WWtobner46F3ZaHf.xls

2024-11-21T07:02:57.074

Excel Document

WWtobner46F3ZaHf.xls

malicious

SHA256: da1c4f9367347abcd2e2b908d4aa475ce8a84e713469a0622d49278f18f10d57

VMRay Threat Identifiers

Severity

Operation

4/5

Malicious file detected via reputation

4/5

Attempts to connect through HTTPS

4/5

Malicious host or URL detected via reputation

4/5

Document tries to create process

4/5

Attempts to connect through HTTP

3/5

Document contains macros inside a hidden Excel worksheet

2/5

Suspicious content matched by YARA rules

1/5

Contains suspicious Office macro

1/5

Content matched by YARA rules

pe7tKyMwpm6XtUJO.xls

2024-11-21T07:01:02.209

Excel Document

pe7tKyMwpm6XtUJO.xls

malicious

SHA256: 2449ba5988d051b6538df80bca953cc6fa729dd78cc4d9a1a02d598cf12aef14

VMRay Threat Identifiers

Severity

Operation

4/5

Malicious file detected via reputation

4/5

Attempts to connect through HTTP

4/5

Attempts to connect through HTTPS

4/5

Connects to a CMS hoster

4/5

Malicious host or URL detected via reputation

3/5

Document contains macros inside a hidden Excel worksheet

2/5

Suspicious content matched by YARA rules

1/5

Contains suspicious Office macro

MYOeBmolNrZ3oREj.xls

2024-11-21T06:58:11.025

Excel Document

MYOeBmolNrZ3oREj.xls

malicious

SHA256: 473bf2123f2891c1a5ebc75949cdf50260d4da3715cd7a3160d09155da8b354b

VMRay Threat Identifiers

Severity

Operation

4/5

Document contains suspicious Office macros which are executed automatically

4/5

Document tries to create process

4/5

Malicious host or URL detected via reputation

4/5

Malicious file detected via reputation

4/5

Attempts to connect through HTTP

3/5

Document contains macros inside a hidden Excel worksheet

2/5

Suspicious content matched by YARA rules

1/5

Contains suspicious Office macro

ORDER-2411210684CAV.XLS.js

2024-11-21T06:57:58.385

JScript

ORDER-2411210684CAV.XLS.js

malicious

SHA256: 17c8a2339fd77b428d7802f12bb967d6bef393b0c16da336126506c8f83c750e

VMRay Threat Identifiers

Severity

Operation

4/5

Tries to detect the presence of antivirus software

4/5

Reads SMB connection information

4/5

Sends control codes to a driver

2/5

Executes dropped PE file

2/5

Queries OS version via WMI

2/5

Collects hardware properties

2/5

Installs system startup script or application

1/5

Accesses volumes directly