Spreadsheet drops executable content disguised as a document
A file recorded as `System.doc` during spreadsheet analysis has the same hash as a separately analysed executable. Both analyses show requests to the same hostname and `/download` path, but the spreadsheet’s recorded response was HTML, not identified executable content.
An Excel spreadsheet’s sandbox report records a file called System.doc in a user-profile .templates directory. Despite its document extension, the file is a Windows executable—and its SHA-256 matches a separately analysed sample called System Manager.exe. The same spreadsheet report records an HTTP request to offlineearthquake.com, a hostname also used in the executable’s independent analysis.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read