analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

89499.doc

Full analysis: https://app.any.run/tasks/54c74a59-49cb-4937-8671-ceb3a6efa7e7
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 19, 2019, 13:02:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Template: Normal.dotm, Last Saved By: Administrator, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Jun 19 01:04:00 2019, Last Saved Time/Date: Wed Jun 19 01:04:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
MD5:

6455E2FC1FB820C6550E5A45843A3863

SHA1:

7F46DEC7E8A97AC64E108FAD803A460D6B10426A

SHA256:

1C52D90E859C62C120BD4CA6639C5C5E505F9CD69CB238E93B826E95FDF5E9EE

SSDEEP:

3072:beGEsV97+V+nwbgIzg8ijqZyJniTqciJqyysDkj9hxXGsn0:EsVGg5Xys+H6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • WINWORD.EXE (PID: 3140)
      • SearchProtocolHost.exe (PID: 1000)
      • vbc.exe (PID: 2980)
      • SearchFilterHost.exe (PID: 2608)
      • com8p6gup.exe (PID: 1688)
      • WINWORD.EXE (PID: 3500)
      • OSPPSVC.EXE (PID: 3128)
      • DllHost.exe (PID: 3832)
      • notepad.exe (PID: 1896)
      • DllHost.exe (PID: 2504)
      • DllHost.exe (PID: 3004)
      • AUDIODG.EXE (PID: 2604)
      • DllHost.exe (PID: 2852)
      • explorer.exe (PID: 116)
      • verclsid.exe (PID: 124)
      • conhost.exe (PID: 1440)
      • cmd.exe (PID: 4032)
      • DllHost.exe (PID: 276)
      • DllHost.exe (PID: 3436)
      • rundll32.exe (PID: 4092)

    • Application was dropped or rewritten from another process

      • com8p6gup.exe (PID: 1688)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3140)

    • Loads the Task Scheduler COM API

      • OSPPSVC.EXE (PID: 3128)

    • Requests a remote executable file from MS Office

      • WINWORD.EXE (PID: 3140)

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3140)

    • Runs app for hidden code execution

      • explorer.exe (PID: 116)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • WINWORD.EXE (PID: 3140)
      • explorer.exe (PID: 116)

    • Executable content was dropped or overwritten

      • vbc.exe (PID: 2980)
      • explorer.exe (PID: 116)

    • Executes scripts

      • com8p6gup.exe (PID: 1688)

    • Creates files in the user directory

      • explorer.exe (PID: 116)

    • Reads default file associations for system extensions

      • explorer.exe (PID: 116)

    • Uses RUNDLL32.EXE to load library

      • explorer.exe (PID: 116)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 116)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3140)
      • WINWORD.EXE (PID: 3500)

    • Starts Microsoft Office Application

      • explorer.exe (PID: 116)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3140)
      • WINWORD.EXE (PID: 3500)

    • Manual execution by user

      • notepad.exe (PID: 1896)
      • WINWORD.EXE (PID: 3500)
      • verclsid.exe (PID: 124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 1
Paragraphs: 1
Lines: 1
Bytes: 11000
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 1
Words: -
Pages: 1
ModifyDate: 2019:06:19 00:04:00
CreateDate: 2019:06:19 00:04:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: Administrator
Template: Normal.dotm
Comments: -
Keywords: -
Author: -
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
20
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winword.exe com8p6gup.exe no specs vbc.exe osppsvc.exe no specs notepad.exe no specs searchprotocolhost.exe no specs searchfilterhost.exe no specs Thumbnail Cache Out of Proc Server no specs audiodg.exe no specs Thumbnail Cache Out of Proc Server no specs Thumbnail Cache Out of Proc Server no specs winword.exe no specs Thumbnail Cache Out of Proc Server no specs verclsid.exe no specs Thumbnail Cache Out of Proc Server no specs explorer.exe Thumbnail Cache Out of Proc Server no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3140"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Downloads\89499.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
1688"C:\Users\admin\AppData\Local\Temp\com8p6gup.exe" C:\Users\admin\AppData\Local\Temp\com8p6gup.exe—WINWORD.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2980"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
com8p6gup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
3128"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE—services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Office Software Protection Platform Service
Version:
14.0.0370.400 (longhorn(wmbla).090811-1833)
1896"C:\Windows\system32\notepad.exe" C:\Windows\system32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1000"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2608"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520 C:\Windows\system32\SearchFilterHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Filter Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3832C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2604C:\Windows\system32\AUDIODG.EXE 0x6c0C:\Windows\system32\AUDIODG.EXE—svchost.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Audio Device Graph Isolation
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2504C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
7 199
Read events
5 424
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
2
Text files
5
Unknown types
21

Dropped files

PID
Process
Filename
Type
3140WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRF682.tmp.cvr —
MD5:—
SHA256:—
3140WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DFF853568311F84E6B.TMP —
MD5:—
SHA256:—
3140WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1A761D00-0908-4675-8CCB-CFEB6046AF61}.tmp —
MD5:—
SHA256:—
3140WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{CEE05924-C404-4DA9-A11B-F004AAF22653}.tmp —
MD5:—
SHA256:—
3140WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\new[1].exeexecutable
MD5:39784103286D89A951728CA5BAD60439
SHA256:CE40B19E76A6046023ED37DC08E20FDDF5D006A21B30AC603C00BABAAA1AD7D9
3500WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR827D.tmp.cvr —
MD5:—
SHA256:—
116explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\macro.txt.lnklnk
MD5:29DEDC8240BEEAB0D8EC7E3E52016A83
SHA256:E9029C7487629836378CC74EE69AA060E7D5613E970123BB14E4AE5F0BD2BFD2
1896notepad.exeC:\Users\admin\Desktop\macro.txttext
MD5:1FA2AE8F9F2B00AEC77E31E833846DF7
SHA256:61AA2F8CD3BA631C553C81B7B54FEDFF58A2A21046EB9E257E6272FDF1ECBDFA
3140WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\89499.doc.LNKlnk
MD5:525D99D6C0D44CFF53E50F350F3D4963
SHA256:ABC2526BD6251BA2514C7AC619DFEEA72A4AADC2177360A0FD75C4829A7E5AE9
116explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\89499.doc.lnklnk
MD5:9826B011630B895292A95B346F23E22B
SHA256:B6E84042245701E3F873C0AFD66C730E8032C29CE9D3670EDF9A5532CC30E4DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3140
WINWORD.EXE
GET
200
104.168.248.254:80
http://citi4.xyz/bin/new.exe
US
executable
450 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3140
WINWORD.EXE
104.168.248.254:80
citi4.xyz
Hostwinds LLC.
US
suspicious

DNS requests

Domain
IP
Reputation
citi4.xyz
  • 104.168.248.254
suspicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3140
WINWORD.EXE
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
3140
WINWORD.EXE
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
3140
WINWORD.EXE
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
89499.doc