xlAutoOpen
Static task
static1
Behavioral task
behavioral1
Sample
HelloWorldXll.xll
Resource
win10-20220812-en
General
-
Target
HelloWorldXll.xll
-
Size
10KB
-
MD5
36ce4fcaeae9e8c997172d78ed20e3e4
-
SHA1
cbbeee41cc5131702076596a5d1939e281b33344
-
SHA256
d433a2328cd4f3b3dfe7ad304974bb8bb890081e75977d0d925455de64fedc61
-
SHA512
867f9c4071bca3e85410aaecea203ac7068f2fa9a232dbbce861c95d26e109457bb994ecf21dc8b02ee45b1a7fb293054ee2baf1be6a1d2579936e963089c0a1
-
SSDEEP
192:u53DzhN0+X3cckbGvsAJeYXs/Wv7lU/k:uxzhNlHLjLJeYXs/C7lX
Malware Config
Signatures
Files
-
HelloWorldXll.xll.xll windows x64
f068c33b7e43cda6e8c5547619d5ac3d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
xlcall32
ord2
vcruntime140
__std_type_info_destroy_list
memset
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_cexit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_initialize_onexit_table
kernel32
GetCurrentProcessId
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
RtlCaptureContext
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
Exports
Exports
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ