File name:

malware.doc

Full analysis: https://app.any.run/tasks/f519e26e-0f4e-4cf3-9a23-f76ebe3e6f8f
Verdict: Malicious activity
Analysis date: May 27, 2025, 20:00:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
cve-2017-11882
exploit
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

CA820A526E7F4BB5D6BB6ACE7DF155B2

SHA1:

6AB81D9C8F19D628D254950DCEDDFE420F832A6E

SHA256:

0E36739707CFD78EFE2B675B3F9F68E370C55C7DE967752A73EAEB7A8CCB54B8

SSDEEP:

6144:Gergf0v3lHTdHDLZg6CxCNDqipLTHWh7MA7gAj3zv:s0PlHTd/ZQCoYLTH1ggWDv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • EXPLOIT has been detected (SURICATA)

      • WINWORD.EXE (PID: 7468)

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 6840)
      • WINWORD.EXE (PID: 8160)

  • SUSPICIOUS

    • Connects to the server without a host name

      • WINWORD.EXE (PID: 7468)
      • WINWORD.EXE (PID: 6840)
      • WINWORD.EXE (PID: 8160)

    • Executes application which crashes

      • WINWORD.EXE (PID: 6840)
      • WINWORD.EXE (PID: 8160)

  • INFO

    • Manual execution by a user

      • cmd.exe (PID: 644)
      • WINWORD.EXE (PID: 8160)
      • WINWORD.EXE (PID: 3884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2025:05:27 13:04:60
ZipCRC: 0x309c932b
ZipCompressedSize: 443
ZipUncompressedSize: 2568
ZipFileName: [Content_Types].xml

XML

Template: Normal.dotm
TotalEditTime: 1 minute
Pages: 1
Words: -
Characters: -
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
Company: Grizli777
LinksUpToDate: No
CharactersWithSpaces: -
SharedDoc: No
HyperlinksChanged: No
AppVersion: 12
Keywords: -
LastModifiedBy: 91974
RevisionNumber: 2
CreateDate: 2025:05:18 17:03:00Z
ModifyDate: 2025:05:18 17:04:00Z

XMP

Title: -
Subject: -
Creator: 91974
Description: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
17
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #EXPLOIT winword.exe sppextcomobj.exe no specs slui.exe ai.exe no specs cmd.exe no specs conhost.exe no specs rundll32.exe no specs openwith.exe no specs slui.exe winword.exe dwwin.exe werfault.exe no specs winword.exe dwwin.exe werfault.exe no specs winword.exe ai.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\WINDOWS\system32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\wldp.dll
3884"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\malware.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4920C:\WINDOWS\system32\dwwin.exe -x -s 4228C:\Windows\System32\DWWIN.EXE
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Error Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dwwin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\version.dll
6060C:\WINDOWS\system32\dwwin.exe -x -s 4516C:\Windows\System32\DWWIN.EXE
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Error Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dwwin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
6480\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6724C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6840"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\malware.doc.docx" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
OpenWith.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
252211219
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7248C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7252C:\WINDOWS\system32\WerFault.exe -u -p 8160 -s 4580C:\Windows\System32\WerFault.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
7468"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\AppData\Local\Temp\malware.doc.docx /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
Total events
37 422
Read events
36 736
Write events
627
Delete events
59

Modification events

(PID) Process:(7468) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems
Operation:writeName:}y-
Value:
7D792D002C1D0000010000000000000007DBFAF841CFDB0100000000
(PID) Process:(7468) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common
Operation:writeName:SessionId
Value:
A019AF5FDBB3044694CA823DA9CCC906
(PID) Process:(7468) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\WINWORD\2200
Operation:delete valueName:0
Value:
ซ鴐㝅娴Ꝇ힬꿹�䙔�닜樁င$驄摽鶲…ީ湕湫睯쥮Ȇ∢්ł¢ᣂ숁씀褎예됏죃캲ǭ჉砃㐶ᇅᆘዒ看椀渀眀漀爀搀⸀攀砀攀씀‖ៅ肀줄࠘㈲㈱䐭捥
(PID) Process:(7468) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\WINWORD\2200
Operation:delete keyName:(default)
Value:
(PID) Process:(7468) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\7468
Operation:writeName:0
Value:
0B0E100E7E3A2B7150FC4B8307F33D486ED7C02300468F83CFC79FE8F3ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C50E8908C91003783634C511AC3AD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(7468) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\FileIO
Operation:writeName:CacheId
Value:
{DFEB7775-5F98-4ADE-A8B8-F1AF32B2C9C9}
(PID) Process:(7468) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\FileIO
Operation:writeName:MetadataReplicationCompleted
Value:
1
(PID) Process:(7468) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\FileIO
Operation:delete valueName:CentralTableFileName
Value:
(PID) Process:(7468) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\FileIO
Operation:writeName:CentralTableFileName
Value:
CentralTable.accdb
(PID) Process:(7468) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\FileIO
Operation:writeName:ExpungeFilesIfDiskFullLastRunTime
Value:
Executable files
0
Suspicious files
132
Text files
59
Unknown types
68

Dropped files

PID
Process
Filename
Type
7468WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:98B8E674F956DD8BFB6154ED710C7E56
SHA256:77E449A174ABE3E12B60FE7E85633F74A68BDB01A6C7ED80DC5060D1623FAA76
7468WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\CC18042A-F2FF-454B-A90A-24232ADD31E2xml
MD5:42E852E11EAAA9C326F0B5D113514C00
SHA256:12763388A89E7369A1C6D7A1786D88AB256C1482079F19AC3ED9E9E48D12D743
7468WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
7468WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:E192462F281446B5D1500D474FBACC4B
SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60
7468WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{C7ACC897-FDD2-40E6-A34E-08A8116BE4AE}.tmpsmt
MD5:830FBF83999E052538EAF156AB6ECB17
SHA256:D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
7468WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D3E33CAF35AFD67E2FD49D09E15909B5_04EECEE476F0EB29549174232867253Bbinary
MD5:0FFD8FF48F1F733782DF0FA4C630722E
SHA256:9110884BF00BB0B86ECEAF3B53E50DC69612BCC1F106D9EF131268AC7E7E37C0
7468WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:51649E9F197650F1C2691DABD55B2328
SHA256:9783846EE221EFAAE3D574B82BB23F91A14C1FB7DB566B8561A80C1D2565930D
7468WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F99D951D.doctext
MD5:9FEC8CF2A72C853744F3CACEC08D7454
SHA256:CEB372BB4B79E14AF6090665BD36E42E7A38F1E7B13BAF964CFC9250222012DA
7468WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{D28035BF-32DD-4592-BBED-B51638A1CA7B}.tmpbinary
MD5:62BE82C95FEEEEAD48F8F79703912D29
SHA256:B0F03D20979F0B2DE897287EF9D6B70E85D6639F0BC3A56850F13EA6CB4E487E
7468WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\63F207A.emfemf
MD5:3D88A540BD8D64F9BD132BAD7738FB31
SHA256:CDE6D2A45FD5542445C16249539FD8DAE87A91A21931B7521283AEA799C24257
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
95
DNS requests
46
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7468
WINWORD.EXE
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7468
WINWORD.EXE
GET
200
184.24.77.45:80
http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgY6qspBkOcnB576yeW36W0Y1A%3D%3D
unknown
—
—
whitelisted
7468
WINWORD.EXE
HEAD
200
107.172.132.32:80
http://107.172.132.32/700/bgv/seethebestthingswithnicepersongivengoodthingsforhim______seethebestthingswithnicepersongivengoodthingsforhim________seethebestthingswithnicepersongivengoodthingsforhim.doc
unknown
—
—
unknown
7468
WINWORD.EXE
GET
200
107.172.132.32:80
http://107.172.132.32/700/bgv/seethebestthingswithnicepersongivengoodthingsforhim______seethebestthingswithnicepersongivengoodthingsforhim________seethebestthingswithnicepersongivengoodthingsforhim.doc
unknown
—
—
unknown
7468
WINWORD.EXE
HEAD
200
107.172.132.32:80
http://107.172.132.32/700/bgv/seethebestthingswithnicepersongivengoodthingsforhim______seethebestthingswithnicepersongivengoodthingsforhim________seethebestthingswithnicepersongivengoodthingsforhim.doc
unknown
—
—
unknown
7468
WINWORD.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
900
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5796
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7468
WINWORD.EXE
52.109.32.97:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
7468
WINWORD.EXE
52.123.128.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7468
WINWORD.EXE
2.16.168.203:443
omex.cdn.office.net
Akamai International B.V.
RU
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
  • 23.48.23.157
  • 23.48.23.154
  • 23.48.23.164
  • 23.48.23.160
  • 23.48.23.150
  • 23.48.23.155
  • 23.48.23.159
  • 23.48.23.166
  • 23.48.23.153
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
  • 52.109.89.18
whitelisted
ecs.office.com
  • 52.123.128.14
  • 52.123.129.14
whitelisted
omex.cdn.office.net
  • 2.16.168.203
  • 2.16.168.206
whitelisted
short.udon-morishige.com
  • 162.43.7.72
unknown
x1.c.lencr.org
  • 23.209.209.135
whitelisted
r11.o.lencr.org
  • 184.24.77.45
  • 184.24.77.77
  • 184.24.77.53
  • 184.24.77.48
  • 184.24.77.54
whitelisted
messaging.lifecycle.office.com
  • 52.111.236.4
whitelisted

Threats

PID
Process
Class
Message
7468
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
7468
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
7468
WINWORD.EXE
Potentially Bad Traffic
ET HUNTING Microsoft Office User-Agent Requesting A Doc File
7468
WINWORD.EXE
Misc Attack
EXPLOIT [ANY.RUN] Obfuscated RTF document including the CLSID of the Equation Editor (CVE-2017-11882)
7468
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
7468
WINWORD.EXE
Misc activity
ET USER_AGENTS Microsoft Office Existence Discovery User-Agent
6840
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
6840
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
6840
WINWORD.EXE
Potentially Bad Traffic
ET HUNTING Microsoft Office User-Agent Requesting A Doc File
6840
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
malware.doc