We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
26 December 2019, 23:08
Analysis environment:
Windows 7 Pro, build 7601, x86
invoice_OPJ92_516.doc
MD5:
C51C3A81E0D0C0E7969C17F78E132F59
SHA1:
69004BA8CB17B01FEBD5DAD543D006B35B25708B
SHA256:
28D045BF0F47D04041D62EE87341CEE6CBB86C64B7FF1355FB42F9633F57754C
Analysis result
Threat level:
Malicious activity
Tags:
macros
macros-on-open
emotet-doc
emotet
generated-doc
Full analysis:
Analysis invoice_OPJ92_516.doc (MD5: C51C3A81E0D0C0E7969C17F78E132F59) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
No malicious indicators.
SUSPICIOUS
PowerShell script executed
powershell.exe (PID: 3984)
Executed via WMI
powershell.exe (PID: 3984)
Creates files in the user directory
powershell.exe (PID: 3984)
INFO
Creates files in the user directory
WINWORD.EXE (PID: 1648)
Reads Microsoft Office registry keys
WINWORD.EXE (PID: 1648)
Threats
No threats detected