invoice[.]xll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

invoice.xll
Size

1.8MB
MD5

6c597b51661876f56a182f904991b75e
SHA1

98f0e976de8f3afb0e89a57d9381022d339f73e6
SHA256

0c0cd1ac629133a1cf54c398fdfa86873925d044a35e0ccd2d5436abe53682f7
SHA512

f9da4de32e79db8193ad29cd485b600e92ccabd5a03270ba591e93606855fc7aa763c7082fb45524e958cab86defe5cff51dc27b25e27f8b159eeb25d5b34e49
SSDEEP

49152:cfSCPc/IpFXuDAzp2SpJIXIj7j6s3716IU6iG:cl33tIXIv13r+

Score

N/A

Malware Config

Signatures

Files

invoice.xll
.xll windows x64

1658b04dfd92708d94667eb216f69ce7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcrypt

BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenRandom

ntdll

RtlUnwindEx
RtlPcToFileHeader
NtQuerySystemInformation
RtlLookupFunctionEntry
RtlCaptureContext
NtQueryInformationProcess
RtlGetVersion
RtlVirtualUnwind

advapi32

RegCreateKeyExW
SystemFunction036
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegCloseKey
RegSetValueExW

iphlpapi

GetAdaptersAddresses
FreeMibTable
GetIfTable2

kernel32

SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetCPInfo
GetCommandLineA
GetSystemTimeAsFileTime
CloseHandle
IsDebuggerPresent
Sleep
GetTickCount64
OpenProcess
VirtualQueryEx
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
ReadProcessMemory
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
GetModuleHandleW
GetCurrentProcess
GetSystemWow64DirectoryW
GetLastError
SetFilePointerEx
GetSystemInfo
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
GetProcAddress
GetModuleFileNameW
GetProcessId
GetExitCodeProcess
IsWow64Process
GetSystemWow64DirectoryA
GlobalMemoryStatusEx
GetLogicalDrives
SwitchToThread
WakeAllConditionVariable
ReleaseSRWLockExclusive
SleepConditionVariableSRW
WakeConditionVariable
AcquireSRWLockExclusive
GetModuleHandleA
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WriteConsoleW
SetLastError
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
FormatMessageW
GetTempPathW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
FindFirstFileW
FindClose
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
SetThreadStackGuarantee
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetCommandLineW
AcquireSRWLockShared
ReleaseSRWLockShared
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
LocalFree
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapSize
GetStringTypeW
GetFileType
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
LCMapStringW
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
EncodePointer
InterlockedFlushSList
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetUserEnum

ole32

CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoUninitialize

oleaut32

SysFreeString
VariantClear
SysAllocString

pdh

PdhCollectQueryData
PdhOpenQueryA
PdhGetFormattedCounterValue
PdhAddEnglishCounterW
PdhCloseQuery
PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleBaseNameW
GetModuleFileNameExW
GetPerformanceInfo
EnumProcessModulesEx

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
LsaEnumerateLogonSessions

shell32

CommandLineToArgvW

ws2_32

getaddrinfo
listen
WSAGetLastError
closesocket
freeaddrinfo
bind
WSAStartup
WSASocketW
getsockopt
select
accept
connect
recv
send
ioctlsocket
getsockname
getpeername
WSASend
WSARecv
setsockopt
WSACleanup

Exports

Exports

xlAutoOpen

Sections

.text
Size: 961KB - Virtual size: 960KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 833KB - Virtual size: 833KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1658b04dfd92708d94667eb216f69ce7

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

ntdll

advapi32

iphlpapi

kernel32

netapi32

ole32

oleaut32

pdh

powrprof

psapi

secur32

shell32

ws2_32

Exports

Exports

Sections

.text Size: 961KB - Virtual size: 960KB

.rdata Size: 833KB - Virtual size: 833KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 30KB - Virtual size: 29KB

_RDATA Size: 512B - Virtual size: 348B

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 961KB - Virtual size: 960KB

.rdata
Size: 833KB - Virtual size: 833KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 30KB - Virtual size: 29KB

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 10KB - Virtual size: 10KB