home

OfficeMix.Setup.exe

Office Mix

Microsoft Corporation

This is a self-extracting archive and installer. The file has been seen being downloaded from livecrescentedu.sharepoint.com and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Office Mix

Version:
0.1.5720.0

MD5:
5007c1b009d0867c8643f82424936a30

SHA-1:
84c6449cfa32c1ca1042e33a9f881237d202c4c0

SHA-256:
81c5580f3b10715eca4935ea7ead753a28337b7d442906c63cb9d3df46de0574

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
4/19/2024 7:44:13 AM UTC  (today)

File size:
6.5 MB (6,845,528 bytes)

Product version:
0.1.5720.0

Copyright:
Copyright (c) Microsoft Corporation. All rights reserved.

Original file name:
OfficeMix.Setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\officemix.setup.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
6/4/2015 12:42:45 PM

Valid to:
9/4/2016 12:42:45 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
330000010A2C79AED7797BA6AC00010000010A

File PE Metadata
Compilation timestamp:
10/13/2015 5:59:40 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
14.0

CTPH (ssdeep):
98304:YGZy6MUf/b/DcR1HvwQXmfjTEncjijVPTetyAH05icvVnceGSuXXCgG0tEH2LKt:YD6MUfDKv2jTMAuLELHPwHGvdRtEHT

Entry address:
0x2A7FD

Entry point:
E8, 91, 03, 00, 00, E9, 80, FE, FF, FF, 3B, 0D, 04, 90, 46, 00, F2, 75, 02, F2, C3, F2, E9, 5B, 07, 00, 00, 55, 8B, EC, EB, 1F, FF, 75, 08, E8, C5, 6C, 00, 00, 59, 85, C0, 75, 12, 83, 7D, 08, FF, 75, 07, E8, 32, 09, 00, 00, EB, 05, E8, 0E, 09, 00, 00, FF, 75, 08, E8, 3C, 6D, 00, 00, 59, 85, C0, 74, D4, 5D, C3, 55, 8B, EC, FF, 75, 08, E8, 3B, 09, 00, 00, 59, 5D, C3, 55, 8B, EC, F6, 45, 08, 01, 56, 8B, F1, C7, 06, 98, F3, 45, 00, 74, 0A, 6A, 0C, 56, E8, D8, FF, FF, FF, 59, 59, 8B, C6, 5E, 5D, C2, 04, 00, CC...
 
[+]

Entropy:
7.8982  (probably packed)

Code size:
291 KB (297,984 bytes)

The file OfficeMix.Setup.exe has been seen being distributed by the following 7 URLs.

https://livecrescentedu.sharepoint.com/sites/YEARFOLDER2014/GENERAL/_layouts/15/download.aspx?SourceUrl=/sites/YEARFOLDER2014/GENERAL/Shared Documents/INSTALLERS/OfficeMix.Setup.exe&FldUrl=&Source=https://livecrescentedu.sharepoint.com/sites/YEARFOLDER2014/GENERAL/.../Home.aspx?RootFolder=/sites/YEARFOLDER2014/GENERAL/Shared Documents/INSTALLERS&FolderCTID=0x012000D7CEAE080FD3274D8CC8E92890EF424C&View={F187CB06-2AD5-4E57-BA09-788BC7561C1B}

https://docs.google.com/uc?authuser=0&id=0Byzeo5Wd3izlanlIOGJsWmNic00&export=download

http://files.downloadnow.com/s/software/14/17/91/.../OfficeMix.Setup.exe

https://doc-0g-00-docs.googleusercontent.com/docs/securesc/lbsgioecu0hmfv0crnl205fq41c5qj0g/po1ovt915tg7rlomneomuftccju400cs/1465545600000/.../13171508442201718168/0B-VH6SyhBPndNHdsV2t6Nk9mejQ?h=14183413689955708237&e=download

temp:OfficeMix.Setup.exe

https://moeae87206-my.sharepoint.com/personal/ashraf276980_moe_ae/_layouts/15/download.aspx?SourceUrl=/personal/ashraf276980_moe_ae/Documents/.../OfficeMix.Setup.exe

https://e0d1.wpc.azureedge.net/80E0D1/OfficeMixProdBlobStorage/.../OfficeMix.Setup.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.