ID: Sample Name: SSB SBV Daily Report - Logistics Template DEC '17 (8).xlsm Cookbook: defaultwindowsofficecookbook.jbs Time: 06:35:29 Date:

Size: px

Start display at page:

Download "ID: Sample Name: SSB SBV Daily Report - Logistics Template DEC '17 (8).xlsm Cookbook: defaultwindowsofficecookbook.jbs Time: 06:35:29 Date:"

Sharlene Henderson
5 years ago
Views:

ID: 41310 Sample Name: SSB SBV Daily Report - Logistics Template DEC '17 (8).

1 ID: Sample Name: SSB SBV Daily Report - Logistics Template DEC '17 (8).xlsm Cookbook: defaultwindowsofficecookbook.jbs Time: 06:35:29 Date: 31/12/2017 Version:

2 Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview Networking: Data Obfuscation: System Summary: Hooking and other Techniques for Hiding and Protection: Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static OLE Info OLE File "xl/vbaproject.bin" Indicators Streams with VBA VBA File Name: Module1.bas, Stream Size: 1712 VBA Code Keywords VBA Code VBA File Name: Sheet1.cls, Stream Size: 977 VBA Code Keywords VBA Code VBA File Name: Sheet2.cls, Stream Size: 977 VBA Code Keywords VBA Code Table of Contents VBA File Name: Sheet3.cls, Stream Size: Copyright Joe Security LLC 2017 Page 2 of

3 VBA Code Keywords VBA Code VBA File Name: Sheet4.cls, Stream Size: 977 VBA Code Keywords VBA Code VBA File Name: Sheet5.cls, Stream Size: 977 VBA Code Keywords VBA Code VBA File Name: ThisWorkbook.cls, Stream Size: 985 VBA Code Keywords VBA Code VBA File Name: UserForm1.frm, Stream Size: VBA Code Keywords VBA Code Streams PROJECT, ASCII text, with CRLF line terminators, Stream Size: 769 PROJECTwm,, Stream Size: 200 UserForm1/\x1CompObj,, Stream Size: 97 UserForm1/\x3VBFrame, ASCII text, with CRLF line terminators, Stream Size: 294 UserForm1/f,, Stream Size: 131 UserForm1/i77/\x1CompObj,, Stream Size: 115 UserForm1/i77/f,, Stream Size: 176 UserForm1/i77/i79/\x1CompObj,, Stream Size: 110 UserForm1/i77/i79/f,, Stream Size: 1060 UserForm1/i77/i79/i102/\x1CompObj,, UserForm1/i77/i79/i102/f,, Stream Size: 173 UserForm1/i77/i79/i102/o,, Stream Size: 56 UserForm1/i77/i79/i104/\x1CompObj,, UserForm1/i77/i79/i104/f,, Stream Size: 173 UserForm1/i77/i79/i104/o,, Stream Size: 56 UserForm1/i77/i79/i106/\x1CompObj,, UserForm1/i77/i79/i106/f,, Stream Size: 177 UserForm1/i77/i79/i106/o,, Stream Size: 56 UserForm1/i77/i79/i108/\x1CompObj,, UserForm1/i77/i79/i108/f,, Stream Size: 165 UserForm1/i77/i79/i108/o,, Stream Size: 56 UserForm1/i77/i79/i110/\x1CompObj,, UserForm1/i77/i79/i110/f,, Stream Size: 185 UserForm1/i77/i79/i110/o,, Stream Size: 104 UserForm1/i77/i79/i113/\x1CompObj,, UserForm1/i77/i79/i113/f,, Stream Size: 193 UserForm1/i77/i79/i113/o,, Stream Size: 104 UserForm1/i77/i79/i116/\x1CompObj,, UserForm1/i77/i79/i116/f,, Stream Size: 197 UserForm1/i77/i79/i116/o,, Stream Size: 104 UserForm1/i77/i79/i119/\x1CompObj,, UserForm1/i77/i79/i119/f,, Stream Size: 197 Copyright Joe Security LLC 2017 Page 3 of

4 UserForm1/i77/i79/i119/o,, Stream Size: UserForm1/i77/i79/i121/\x1CompObj,, UserForm1/i77/i79/i121/f,, Stream Size: UserForm1/i77/i79/i121/o,, Stream Size: UserForm1/i77/i79/i124/\x1CompObj,, UserForm1/i77/i79/i124/f,, Stream Size: UserForm1/i77/i79/i124/o,, Stream Size: UserForm1/i77/i79/i126/\x1CompObj,, UserForm1/i77/i79/i126/f,, Stream Size: UserForm1/i77/i79/i126/o,, Stream Size: UserForm1/i77/i79/i129/\x1CompObj,, UserForm1/i77/i79/i129/f,, Stream Size: UserForm1/i77/i79/i129/o,, Stream Size: UserForm1/i77/i79/i132/\x1CompObj,, UserForm1/i77/i79/i132/f,, Stream Size: UserForm1/i77/i79/i132/o,, Stream Size: UserForm1/i77/i79/i134/\x1CompObj,, UserForm1/i77/i79/i134/f,, Stream Size: UserForm1/i77/i79/i134/o,, Stream Size: UserForm1/i77/i79/i136/\x1CompObj,, UserForm1/i77/i79/i136/f,, Stream Size: UserForm1/i77/i79/i136/o,, Stream Size: UserForm1/i77/i79/i171/\x1CompObj,, UserForm1/i77/i79/i171/f,, Stream Size: UserForm1/i77/i79/i171/o,, Stream Size: UserForm1/i77/i79/i173/\x1CompObj,, UserForm1/i77/i79/i173/f,, Stream Size: UserForm1/i77/i79/i173/o,, Stream Size: UserForm1/i77/i79/i175/\x1CompObj,, UserForm1/i77/i79/i175/f,, Stream Size: UserForm1/i77/i79/i175/o,, Stream Size: UserForm1/i77/i79/i178/\x1CompObj,, UserForm1/i77/i79/i178/f,, Stream Size: UserForm1/i77/i79/i178/o,, Stream Size: UserForm1/i77/i79/i181/\x1CompObj,, UserForm1/i77/i79/i181/f,, Stream Size: UserForm1/i77/i79/i181/o,, Stream Size: UserForm1/i77/i79/i183/\x1CompObj,, UserForm1/i77/i79/i183/f,, Stream Size: UserForm1/i77/i79/i183/o,, Stream Size: UserForm1/i77/i79/i185/\x1CompObj,, UserForm1/i77/i79/i185/f,, Stream Size: UserForm1/i77/i79/i185/o,, Stream Size: Copyright Joe Security LLC 2017 Page 4 of 45

5 UserForm1/i77/i79/i192/\x1CompObj,, UserForm1/i77/i79/i192/f,, Stream Size: 185 UserForm1/i77/i79/i192/o,, Stream Size: 56 UserForm1/i77/i79/i97/\x1CompObj,, UserForm1/i77/i79/i97/f,, Stream Size: 209 UserForm1/i77/i79/i97/i99/\x1CompObj,, UserForm1/i77/i79/i97/i99/f,, Stream Size: 156 UserForm1/i77/i79/i97/i99/o,, Stream Size: 104 UserForm1/i77/i79/i97/o,, Stream Size: 56 UserForm1/i77/i79/o,, Stream Size: 56 UserForm1/i77/i80/\x1CompObj,, Stream Size: 110 UserForm1/i77/i80/f,, Stream Size: 48 UserForm1/i77/i80/o, empty, Stream Size: 0 UserForm1/i77/o,, Stream Size: 152 UserForm1/i77/x,, Stream Size: 48 UserForm1/o, empty, Stream Size: 0 VBA/_VBA_PROJECT,, Stream Size: 5054 VBA/ SRP_0,, Stream Size: 1653 VBA/ SRP_1,, Stream Size: 106 VBA/ SRP_2,, Stream Size: 198 VBA/ SRP_3,, Stream Size: 144 VBA/dir,, Stream Size: 952 Network Behavior Code Manipulations Statistics System Behavior Analysis Process: EXCEL.EXE PID: 3288 Parent PID: 2944 File Activities File Created File Written Registry Activities Key Created Disassembly Code Analysis Copyright Joe Security LLC 2017 Page 5 of 45

Analysis Report Overview Information Joe Sandbox Version: 20.0.0 Analysis ID: 41310 Start time: 06:35:29 Joe Sandbox Product: CloudBasic Start date: 31.12.

6 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 06:35:29 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: 0h 3m 37s Sample file name: SSB SBV Daily Report - Logistics Template DEC '17 (8).xlsm Cookbook file name: false light defaultwindowsofficecookbook.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: SUS HCA enabled EGA enabled HDC enabled GSI enabled (VBA) sus21.evad.winxlsm@1/4@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Found application associated with file extension:.xlsm Found Word or Excel or PowerPoint document Simulate clicks Number of clicks 1 Close Viewer Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, dllhost.exe Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: EXCEL.EXE Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Copyright Joe Security LLC 2017 Page 6 of 45

clean clean clean Exploiter Banker Spyware

7 Confidence Strategy Score Range Further Analysis Required? Threshold true Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice No malicious behavior found, analyze the document also on other version of Office / Acrobat Copyright Joe Security LLC 2017 Page 7 of 45

8 Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Signature Overview Networking Data Obfuscation System Summary Hooking and other Techniques for Hiding and Protection Click to jump to signature section Networking: Urls found in memory or binary Data Obfuscation: Document contains an embedded VBA with many string operations indicating source code obfuscation System Summary: Checks whether correct version of.net is installed Found graphical window changes (likely an installer) Document is a ZIP file with path names indicative for goodware Checks if Microsoft Office is installed Uses new MSVCR Dlls Binary contains paths to debug symbols Binary contains paths to development resources Classification label Creates temporary files Reads ini files Reads software policies Sample is known by Antivirus (Virustotal or Metascan) Uses an in-process (OLE) Automation server Document contains embedded VBA macros Document misses a certain OLE stream usually present in this Microsoft Office document type Office document includes a Visual Basic Macro Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Copyright Joe Security LLC 2017 Page 8 of 45

9 Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Source Detection Cloud Link SSB SBV Daily Report - Logistics Template DEC '17 (8).xlsm 0% virustotal Browse Dropped Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context Copyright Joe Security LLC 2017 Page 9 of 45

10 ASN No context Dropped Files No context Screenshot Startup System is w7 cleanup EXCEL.EXE (PID: 3288 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /dde MD5: EDBB91DA84FC102425BFDA957E) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\VBE\MSForms.exd MD5: BD20550A E2F7D8E0480A5EE3 Copyright Joe Security LLC 2017 Page 10 of 45

11 C:\Users\HERBBL~1\AppData\Local\Temp\VBE\MSForms.exd SHA1: SHA-256: SHA-512: Malicious: Reputation: 79E3DDBC1A4EA661D2B965E5C949BC8AE2F5D2DF 5C48D5ABF8C5A57409B9BBF4265B328D11401BB300E17B9F2D7D89ED378D76CC 0830CEEFF48EB400A64F9D3BD039876E507E3E46F0EACB52AC25C6660F4D1DD35A51C6AB299B31D536D8A5785CDE7106 DF5566D03B4FA00A7316BB0D63C8DC0E false low C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\SSB SBV Daily Report - Logistics Template DEC '17 (8).LNK MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=sun Sep 24 13:59: , mtime=sun Sep 24 13:59: , atime=sun Dec 31 05:35: , length=79292, window=hide MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: D15FD6E801A98D9F44F9B2C882E8E3FF A9B8A0B6977A65268FD31C9B02D55 59BECBCD1038FE477F2A6B A454542F D8EBE DFB37A8B46EE8D51B7599FED40FAF D2D1E1972DF5E2A1158DFE6FAB923675C8D251B12242C7430A7A 20BC8D0B32119A4E922C0D false low C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: ASCII text, with CRLF line terminators BFD56CC4DA6F BF8A77BD7B2 287F2E251E23408D8FF408EA92B2FAE03918CD71 FABD49DA68DF590A8A7955FC4D894207D5ADA28BCFB71FC7F6F92AEF4D84C306 5B9FC2DE3E072AF4C14F79F703A0713F753B85909D6DE4A78E6379E85F16E1745A8BA6EB1653AACAF84C648317F A1FECE17F298C5371B8F161B270BE28 false low C:\Users\user\Desktop\~$SSB SBV Daily Report - Logistics Template DEC '17 (8).xlsm MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 3DB57C825E10B373BE838EB89784C B7A62E5D5A234CB3D654A4CDD02F8EAA8BEE0 1C6801A064A0D077FD545EE311F68B65E7F2900C0C0E93A2AA64918AE31BC444 2AB92D7DAD022614DE5FDAD6378EE2D3E4796AFCC98DA3C6D96A475A1EE4773DB9DCB687B6A651EF9EC2201B688ED2 F0557A92DCDC5B7CA86F9B966A82A1C563 true moderate, very likely benign file Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: Microsoft Excel TrID: Excel Microsoft Office Open XML Format document with Macro (57504/1) 51.34% Excel Microsoft Office Open XML Format document (50504/1) 45.09% ZIP compressed archive (4004/1) 3.57% File name: SSB SBV Daily Report - Logistics Template DEC '17 (8).xlsm File size: MD5: SHA1: eb396b45d9cbf6e9c3d021b113329f59 845fb107b ea7655f4a9783cc3fd238 Copyright Joe Security LLC 2017 Page 11 of 45

12 SHA256: SHA512: bff cf74c135a05c97ce0488bbfdb5f3dd24 dde51d069c5142b1 3e55dd48f4c8bc82d7e59c7a42dc904ecd51582cebc e5a05d75d75d911821bade e63654d c1ea6017f9aebb05b3be9928da3072bc3192 File Content Preview: PK...!.*q...[Content_Types].xml...( File Icon Static OLE Info Document Type: OpenXML Number of OLE Files: 1 OLE File "xl/vbaproject.bin" Indicators Has Summary Info: Application Name: unknown Encrypted Document: Contains Word Document Stream: Contains Workbook/Book Stream: Contains PowerPoint Document Stream: Contains Visio Document Stream: Contains ObjectPool Stream: Flash Objects Count: 0 Contains VBA Macros: True Streams with VBA VBA File Name: Module1.bas, Stream Size: 1712 VBA File Name: Stream Size: 1712 VBA/Module1 Module1.bas : > 1 P x M E Data Raw: f c d b ff ff ff ff 3a ba e ff ff ff b6 00 ff ff ff ff ff ff ff ff ff ff VBA Code Keywords Keyword Call_UF() Attribute Clear_month.VB_ProcData.VB_Invoke_Func Clear_month() VB_Name Selection.ClearContents Macro VBA Code VBA File Name: Sheet1.cls, Stream Size: 977 Copyright Joe Security LLC 2017 Page 12 of 45

13 VBA File Name: Stream Size: 977 VBA/Sheet1 Sheet1.cls > # x M E Data Raw: f c d ff ff ff ff cb f e d ff ff b6 00 ff ff ff ff ff ff ff ff ff ff ff ff VBA Code Keywords Keyword VB_Exposed Attribute VB_Name VB_Creatable VB_PredeclaredId VB_GlobalNameSpace VB_Base VB_Customizable VB_TemplateDerived VBA Code VBA File Name: Sheet2.cls, Stream Size: 977 VBA File Name: Stream Size: 977 VBA/Sheet2 Sheet2.cls > 1 ` a.... # x M E Data Raw: f c d ff ff ff ff cb f e ff ff b6 00 ff ff ff ff ff ff ff ff ff ff ff ff VBA Code Keywords Keyword VB_Exposed Attribute VB_Name VB_Creatable VB_PredeclaredId VB_GlobalNameSpace VB_Base VB_Customizable VB_TemplateDerived VBA Code VBA File Name: Sheet3.cls, Stream Size: 977 VBA/Sheet3 VBA File Name: Sheet3.cls Stream Size: 977 Copyright Joe Security LLC 2017 Page 13 of 45

14 > # x M E Data Raw: f c d ff ff ff ff cb f e 31 a0 7f ff ff b6 00 ff ff ff ff ff ff ff ff ff ff ff ff VBA Code Keywords Keyword VB_Exposed Attribute VB_Name VB_Creatable VB_PredeclaredId VB_GlobalNameSpace VB_Base VB_Customizable VB_TemplateDerived VBA Code VBA File Name: Sheet4.cls, Stream Size: 977 VBA File Name: Stream Size: 977 VBA/Sheet4 Sheet4.cls > 1. I.... # x M E Data Raw: f c d ff ff ff ff cb f e 31 be ff ff b6 00 ff ff ff ff ff ff ff ff ff ff ff ff VBA Code Keywords Keyword VB_Exposed Attribute VB_Name VB_Creatable VB_PredeclaredId VB_GlobalNameSpace VB_Base VB_Customizable VB_TemplateDerived VBA Code VBA File Name: Sheet5.cls, Stream Size: 977 VBA File Name: Stream Size: 977 VBA/Sheet5 Sheet5.cls > # x M E Copyright Joe Security LLC 2017 Page 14 of 45

15 Data Raw: f c d ff ff ff ff cb f e 31 fd be ff ff b6 00 ff ff ff ff ff ff ff ff ff ff ff ff VBA Code Keywords Keyword VB_Exposed Attribute VB_Name VB_Creatable VB_PredeclaredId VB_GlobalNameSpace VB_Base VB_Customizable VB_TemplateDerived VBA Code VBA File Name: ThisWorkbook.cls, Stream Size: 985 VBA File Name: Stream Size: 985 VBA/ThisWorkbook ThisWorkbook.cls > 1 B..... # x M E Data Raw: f c d ff ff ff ff cb f e d ff ff b6 00 ff ff ff ff ff ff ff ff ff ff ff ff VBA Code Keywords Keyword VB_Exposed Attribute VB_Name VB_Creatable "ThisWorkbook" VB_PredeclaredId VB_GlobalNameSpace VB_Base VB_Customizable VB_TemplateDerived VBA Code VBA File Name: UserForm1.frm, Stream Size: VBA File Name: Stream Size: VBA/UserForm1 UserForm1.frm L s ' > 1 K x M E Data Raw: f d c ff ff ff ff e 31 4b 7f ff ff b6 00 ff ff ff ff ff ff ff ff ff ff ff ff Copyright Joe Security LLC 2017 Page 15 of 45

16 VBA Code Keywords Keyword 'Last Format(Sheets("Capture").Range("A" VB_Base VB_Creatable VB_Exposed Attribute VB_PredeclaredId VB_GlobalNameSpace Sheets("Capture").Range("A" VB_Name Private VB_Customizable VB_TemplateDerived "HH:MM") VBA Code Streams PROJECT, ASCII text, with CRLF line terminators, Stream Size: 769 Stream Size: 769 PROJECT Entropy: ASCII text, with CRLF line terminators True I D = " { A 2 F 6 8 A 8 D - D E C A D F 6 D 2 1 } ".. D o c u m e n t = T h i s W o r k b o o k / & H D o c u m e n t = S h e e t 1 / & H D o c u m e n t = S h e e t 2 / & H P a c k a g e = { A C 9 F 2 F E C E - 9 F A A A 4 F }.. B a s e C l a s s = U s e r F o r m 1.. M o d u l e = M o d u l e 1.. D o c u m e n t = S h e e t 3 / & H D o c u m e n t Data Raw: d 22 7b d d d d d 22 0d 0a 44 6f d 65 6e 74 3d f 72 6b 62 6f 6f 6b 2f d 0a 44 6f d 65 6e 74 3d f d 0a 44 6f d 65 6e 74 3d f PROJECTwm,, Stream Size: 200 Stream Size: 200 PROJECTwm Entropy: T h i s W o r k b o o k. T. h. i. s. W. o. r. k. b. o. o. k... S h e e t 1. S. h. e. e. t S h e e t 2. S. h. e. e. t U s e r F o r m 1. U. s. e. r. F. o. r. m M o d u l e 1. M. o. d. u. l. e S h e e t 3. S. h. e. e. t S h e e t 4. S. h. e. e. t S h e e t 5. S. h. e. e. t Data Raw: f 72 6b 62 6f 6f 6b f b f 00 6f 00 6b f 72 6d f d d 6f c d 00 6f c UserForm1/\x1CompObj,, Stream Size: 97 UserForm1/\x1CompObj Stream Size: 97 Entropy: Copyright Joe Security LLC 2017 Page 16 of 45

17 M i c r o s o f t F o r m s 2. 0 F o r m..... E m b e d d e d O b j e c t q Data Raw: fe ff 03 0a ff ff ff ff d f 73 6f f 72 6d e f 72 6d d f 62 6a f4 39 b UserForm1/\x3VBFrame, ASCII text, with CRLF line terminators, Stream Size: 294 Stream Size: 294 UserForm1/\x3VBFrame Entropy: ASCII text, with CRLF line terminators V E R S I O N B e g i n { C 6 2 A 6 9 F D C C E - 9 E A A A 4 F } U s e r F o r m 1.. C a p t i o n = " U s e r F o r m 1 ".. C l i e n t H e i g h t = C l i e n t L e f t = C l i e n t T o p = C l i e n t W i d t h = S t a r t U p P o s i t i o n = 1 ' C e n t e r O w Data Raw: True f 4e e d 0a e 20 7b d d d d d f 72 6d d 0a f 6e d f 72 6d d 0a c e d 20 UserForm1/f,, Stream Size: 131 Stream Size: 131 UserForm1/f Entropy: $ }... Y.. K R K. Q D B... T a h o m a ( M... # M u l t i P a g e Data Raw: c 10 0c c ff ff f d b e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d d a d d 75 6c e UserForm1/i77/\x1CompObj,, Stream Size: 115 Stream Size: 115 UserForm1/i77/\x1CompObj Entropy: p.. F z? a M i c r o s o f t F o r m s 2. 0 F o r m..... E m b e d d e d O b j e c t..... F o r m s. M u l t i P a g e q Data Raw: fe ff 03 0a ff ff ff ff e3 46 7a 3f ce 11 be d6 00 aa d f 73 6f f 72 6d e f 72 6d d f 62 6a f 72 6d 73 2e 4d 75 6c UserForm1/i77/f,, Stream Size: 176 Stream Size: 176 UserForm1/i77/f Entropy: $. H p.... }.. L Y p N $ O... # P a g e 1 O n ,..... $ P...! P a g e 2 O n , Data Raw: c 00 0c c c d c e e d f f 6e c d Copyright Joe Security LLC 2017 Page 17 of 45

18 UserForm1/i77/i79/\x1CompObj,, Stream Size: 110 Stream Size: 110 Entropy: Data Raw: UserForm1/i77/i79/\x1CompObj i * W J O.... M i c r o s o f t F o r m s 2. 0 F o r m..... E m b e d d e d O b j e c t..... F o r m s. F o r m q fe ff 03 0a ff ff ff ff f0 69 2a c6 dc 16 ce 11 9e aa a 4f d f 73 6f f 72 6d e f 72 6d d f 62 6a d f 72 6d 73 2e 46 6f 72 6d 2e f4 39 b UserForm1/i77/i79/f,, Stream Size: 1060 Stream Size: 1060 UserForm1/i77/i79/f Entropy: $. H C.... }... X r.. $ a... # F r a m e $ f... # F r a m e $ h... # F r a m e $ j... # F r a m e $ l... # F r a m e $. Data Raw: c 00 0c c d e f d e d ca d e d UserForm1/i77/i79/i102/\x1CompObj,, UserForm1/i77/i79/i102/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i102/f,, Stream Size: 173 Stream Size: 173 UserForm1/i77/i79/i102/f Entropy: H... g } N E D A r e a / R e g i o n.. R K. Q D B... T a h o m h o A g C o m b o B o x 2 E e N E D _ R E G I O N e. Data Raw: c 1a 0c f ff ff d f e f f 6e e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d f e UserForm1/i77/i79/i102/o,, Stream Size: 56 UserForm1/i77/i79/i102/o Stream Size: 56 Entropy: Copyright Joe Security LLC 2017 Page 18 of 45

19 .... A H.,.... ]... { T a h o m a.. Data Raw: b c d b a f 6d UserForm1/i77/i79/i104/\x1CompObj,, UserForm1/i77/i79/i104/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i104/f,, Stream Size: 173 Stream Size: 173 UserForm1/i77/i79/i104/f Entropy: H... i } R u n / T e a m N u m b e r.. R K. Q D B... T a h o m h o A i C o m b o B o x 3 N e R U N _ N U M B E R e. Data Raw: c 1a 0c f ff ff d f e 2f d 20 4e 75 6d e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d f e UserForm1/i77/i79/i104/o,, Stream Size: 56 Stream Size: 56 UserForm1/i77/i79/i104/o Entropy: A H.,.... ]... { T a h o m a.. Data Raw: b c d b a f 6d 61 7f 00 UserForm1/i77/i79/i106/\x1CompObj,, UserForm1/i77/i79/i106/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i106/f,, Stream Size: 177 UserForm1/i77/i79/i106/f Stream Size: 177 Entropy: Copyright Joe Security LLC 2017 Page 19 of 45

20 .. D. H... k } V e h i c l e R e g i s t r a t o n. R K. Q D B... T a h o m h o A k C o m b o B o x 4 R e V E H I C L E _ R E G. Data Raw: c 1a 0c 6b ff ff d f c f 6e e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d f e UserForm1/i77/i79/i106/o,, Stream Size: 56 Stream Size: 56 UserForm1/i77/i79/i106/o Entropy: A H.,.... ]... { T a h o m a x 2 Data Raw: b c d b a f 6d UserForm1/i77/i79/i108/\x1CompObj,, UserForm1/i77/i79/i108/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i108/f,, Stream Size: 165 Stream Size: 165 UserForm1/i77/i79/i108/f Entropy: H. H... m } T o t a l S B V s t a f f o n t r u c k. R K. Q D B... T a h o m a h o.. ( m C o m b o B o x 9 E G Data Raw: c 1a 0c 6d ff ff d f f c f 6e b e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d f e UserForm1/i77/i79/i108/o,, Stream Size: 56 Stream Size: 56 UserForm1/i77/i79/i108/o Entropy: A H.,.... q... { T a h o m a 3. Data Raw: b c b a f 6d UserForm1/i77/i79/i110/\x1CompObj,, UserForm1/i77/i79/i110/\x1CompObj Copyright Joe Security LLC 2017 Page 20 of 45

21 n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i110/f,, Stream Size: 185 Stream Size: 185 UserForm1/i77/i79/i110/f Entropy: H... p } D u t y O n.. R K. Q D B... T a h o m a.... T o.. $ o T e x t B o x $ p T e x t B o x 2 " Data Raw: c 1a 0c ff ff d f f 6e 0a e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d f e f UserForm1/i77/i79/i110/o,, Stream Size: 104 Stream Size: 104 UserForm1/i77/i79/i110/o Entropy: H., {... { T a h o m a t e H., {... { T a h o m a t e Data Raw: b c 7b b a f 6d b c 7b b a f 6d UserForm1/i77/i79/i113/\x1CompObj,, UserForm1/i77/i79/i113/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i113/f,, Stream Size: 193 Stream Size: 193 UserForm1/i77/i79/i113/f Entropy: H... s } T i m e B a s e D e p a r t. R K. Q D B... T a h o m a.... T o.. $ r T e x t B o x $ s T e x t B o x 4 " Data Raw: c 1a 0c ff ff d f d e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d f e Copyright Joe Security LLC 2017 Page 21 of 45

22 UserForm1/i77/i79/i113/o,, Stream Size: 104 Stream Size: 104 UserForm1/i77/i79/i113/o Entropy: H., {... { T a h o m a e H., {.. { T a h o m a e 6 Data Raw: b c 7b b a f 6d b c 7b b a f 6d UserForm1/i77/i79/i116/\x1CompObj,, UserForm1/i77/i79/i116/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i116/f,, Stream Size: 197 Stream Size: 197 UserForm1/i77/i79/i116/f Entropy: D. H... v } A r r i v a l F i r s t S i t e t. R K. Q D B... T a h o m a.... T o.. $ u T e x t B o x $ v T e x t B o x 6 " Data Raw: c 1a 0c ff ff d f c e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d f e UserForm1/i77/i79/i116/o,, Stream Size: 104 Stream Size: 104 UserForm1/i77/i79/i116/o Entropy: H., {... { T a h o m a / H., {.. { T a h o m a /. Data Raw: b c 7b b a f 6d 61 2f b c 7b b a f 6d 61 2f 00 UserForm1/i77/i79/i119/\x1CompObj,, UserForm1/i77/i79/i119/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m Copyright Joe Security LLC 2017 Page 22 of 45

23 UserForm1/i77/i79/i119/f,, Stream Size: 197 Stream Size: 197 UserForm1/i77/i79/i119/f Entropy: P. H... x } A T M T e r m i n a l N u m b e r - F i r s t S i t e O.. R K. Q D B... T a h o m a.... H..... h A x C o m b o B o x 7 E G A T M _ T E R M I N A L _ N U M B E R t Data Raw: c 1a 0c e ff ff d f d d 69 6e 61 6c 20 4e 75 6d d f e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d UserForm1/i77/i79/i119/o,, Stream Size: 56 Stream Size: 56 UserForm1/i77/i79/i119/o Entropy: A H.,.... ]... { T a h o m a x 8 Data Raw: b c d b a f 6d UserForm1/i77/i79/i121/\x1CompObj,, UserForm1/i77/i79/i121/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i121/f,, Stream Size: 197 Stream Size: 197 UserForm1/i77/i79/i121/f Entropy: D. H... { } L a s t S i t e D e p a r t u r e t. R K. Q D B... T a h o m a.... T o.. $ z T e x t B o x $ { T e x t B o x 8 " Data Raw: c 1a 0c 7b ff ff d f c e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d f e UserForm1/i77/i79/i121/o,, Stream Size: 104 UserForm1/i77/i79/i121/o Copyright Joe Security LLC 2017 Page 23 of 45

24 Stream Size: 104 Entropy: H., {... { T a h o m a H., {.. { T a h o m a.. Data Raw: b c 7b b a f 6d 61 ff ff b c 7b b a f 6d 61 ff ff UserForm1/i77/i79/i124/\x1CompObj,, UserForm1/i77/i79/i124/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i124/f,, Stream Size: 197 Stream Size: 197 UserForm1/i77/i79/i124/f Entropy: P. H... } } A T M T e r m i n a l N u m b e r - L a s t S i t e.. R K. Q D B... T a h o m a.... H..... h A } C o m b o B o x 8 E G A T M _ T E R M I N A L _ N U M B E R t Data Raw: c 1a 0c 7d f ff ff d f d d 69 6e 61 6c 20 4e 75 6d d 20 4c e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d UserForm1/i77/i79/i124/o,, Stream Size: 56 Stream Size: 56 UserForm1/i77/i79/i124/o Entropy: A H.,.... ]... { T a h o m a x 9 Data Raw: b c d b a f 6d UserForm1/i77/i79/i126/\x1CompObj,, UserForm1/i77/i79/i126/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i126/f,, Stream Size: 193 Copyright Joe Security LLC 2017 Page 24 of 45

25 Stream Size: 193 UserForm1/i77/i79/i126/f Entropy: <. H } A r r i v a l B a s e. R K. Q D B... T a h o m a.... X o.. $ T e x t B o x ( T e x t B o x 1 0 E G. " Data Raw: c c 1a 0c c ff ff d f c e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d f e f UserForm1/i77/i79/i126/o,, Stream Size: 104 Stream Size: 104 UserForm1/i77/i79/i126/o Entropy: H., {... { T a h o m a H., {.. { T a h o m a.. Data Raw: b c 7b b a f 6d 61 ff ff b c 7b b a f 6d 61 ff ff UserForm1/i77/i79/i129/\x1CompObj,, UserForm1/i77/i79/i129/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i129/f,, Stream Size: 193 Stream Size: 193 UserForm1/i77/i79/i129/f Entropy: H } O f f D u t y. R K. Q D B... T a h o m a.... \\ o.. ( T e x t B o x 1 3 E G ( T e x t B o x 1 4 E G. " Data Raw: c 1a 0c ff ff d f f e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d c f e UserForm1/i77/i79/i129/o,, Stream Size: 104 Stream Size: 104 UserForm1/i77/i79/i129/o Entropy: H., {... { T a h o m a H., {.. { T a h o m a 7 9 Copyright Joe Security LLC 2017 Page 25 of 45

26 Data Raw: b c 7b b a f 6d b c 7b b a f 6d UserForm1/i77/i79/i132/\x1CompObj,, UserForm1/i77/i79/i132/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i132/f,, Stream Size: 157 Stream Size: 157 UserForm1/i77/i79/i132/f Entropy: H } S t a r t i n g M i l e a g e. R K. Q D B... T a h o m a h o.. ( T e x t B o x 1 5 E G Data Raw: c 1a 0c ff ff d f e d 69 6c e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d f e UserForm1/i77/i79/i132/o,, Stream Size: 52 Stream Size: 52 UserForm1/i77/i79/i132/o Entropy: H.,.... { T a h o m a.. Data Raw: b c bf 0a b a f 6d 61 ff ff UserForm1/i77/i79/i134/\x1CompObj,, UserForm1/i77/i79/i134/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i134/f,, Stream Size: 157 UserForm1/i77/i79/i134/f Stream Size: 157 Entropy: Copyright Joe Security LLC 2017 Page 26 of 45

27 H } E n d i n g M i l e a g e r t R K. Q D B... T a h o m a h o.. ( T e x t B o x 1 6 E G Data Raw: c 1a 0c e ff ff d f e e d 69 6c e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d f e UserForm1/i77/i79/i134/o,, Stream Size: 52 Stream Size: 52 UserForm1/i77/i79/i134/o Entropy: H.,.... { T a h o m a 7. Data Raw: b c bf 0a b a f 6d ff UserForm1/i77/i79/i136/\x1CompObj,, UserForm1/i77/i79/i136/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i136/f,, Stream Size: 281 Stream Size: 281 UserForm1/i77/i79/i136/f Entropy: H } R u n D a t e. R K. Q D B... T a h o m a o.. ( T e x t B o x 2 0 / S u ( T e x t B o x 2 1 / S u " ( T e x t B o x 2 2 / S u q ( X.. Data Raw: c 1a 0c be ff ff d f e e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d b f e UserForm1/i77/i79/i136/o,, Stream Size: 244 Stream Size: 244 UserForm1/i77/i79/i136/o Entropy: H., {... { T a h o m a / H., {.. { T a h o m a / H., "... { T a h o m a / F i P / H o l i d a y / S u n d a y T a h o m a.. Data Raw: b c 7b b a f 6d 61 2f b c 7b b a f 6d 61 2f b c b Copyright Joe Security LLC 2017 Page 27 of 45

28 UserForm1/i77/i79/i171/\x1CompObj,, UserForm1/i77/i79/i171/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i171/f,, Stream Size: 185 Stream Size: 185 UserForm1/i77/i79/i171/f Entropy: L. H } T o t a l S B V s t a f f o n s t a n d b y... R K. Q D B... T a h o m h o A C o m b o B o x 1 0 S u N U M B E R _ S T A F F Data Raw: c c 1a 0c ac a ff ff d f f c f 6e e e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b f 6d f UserForm1/i77/i79/i171/o,, Stream Size: 56 Stream Size: 56 UserForm1/i77/i79/i171/o Entropy: A H.,.... q... { T a h o m a.. Data Raw: b c b a f 6d 61 c4 0a UserForm1/i77/i79/i173/\x1CompObj,, UserForm1/i77/i79/i173/\x1CompObj n ` ` M i c r o s o f t F o r m s 2. 0 F r a m e..... E m UserForm1/i77/i79/i173/f,, Stream Size: 185 Stream Size: 185 UserForm1/i77/i79/i173/f Entropy: L. H } T o t a l S B V s t a f f o n c a l l o u t.. R K. Q D B... T a h o m h o A C o m b o B o x 1 1 F F N U M B E R _ S T A F F Copyright Joe Security LLC 2017 Page 28 of 45

ID: Sample Name: PO xls Cookbook: defaultwindowsofficecookbook.jbs Time: 03:13:36 Date: 08/01/2018 Version:

ID: Sample Name: PO xls Cookbook: defaultwindowsofficecookbook.jbs Time: 03:13:36 Date: 08/01/2018 Version: ID: 41861 Sample Name: PO65445465.xls Cookbook: defaultwindowsofficecookbook.jbs Time: 03::36 Date: 08/01/2018 Version: 20.0.0 Table of Contents Analysis Report Overview Information Detection Confidence