File name: | 44ca56bc6b5ab5b825f95888e7d680c6_44ca56bc6b5ab5b825f95888e7d680c6(1).doc |
Full analysis: | https://app.any.run/tasks/11a18a46-2d97-4c1f-ac23-19885297a7d8 |
Verdict: | Malicious activity |
Analysis date: | October 14, 2019, 02:03:57 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
File info: | Microsoft Word 2007+ |
MD5: | 44CA56BC6B5AB5B825F95888E7D680C6 |
SHA1: | 7A1D680B3A7C40AC075EAEEEE6B7244F7CCE0167 |
SHA256: | 2BF8E15FF532F44ABC8B0C1A9703121C19C86A0A29B38B2D4245F7D0710BA183 |
SSDEEP: | 3072:eMI8FYrRd6RW2P7eo8LfOA5q/rnGeoJ+ob5NEfhhPdUq:en8FWP6w67luOUyGDsS5NGtl |
.docm | | | Word Microsoft Office Open XML Format document (with Macro) (53.6) |
---|---|---|
.docx | | | Word Microsoft Office Open XML Format document (24.2) |
.zip | | | Open Packaging Conventions container (18) |
.zip | | | ZIP compressed archive (4.1) |
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0006 |
ZipCompression: | Deflated |
ZipModifyDate: | 1980:01:01 00:00:00 |
ZipCRC: | 0x71d623f0 |
ZipCompressedSize: | 458 |
ZipUncompressedSize: | 1960 |
ZipFileName: | [Content_Types].xml |
Title: | - |
---|---|
Subject: | - |
Creator: | Tender |
Keywords: | - |
---|---|
LastModifiedBy: | m.synytca |
RevisionNumber: | 4 |
CreateDate: | 2019:10:03 12:14:00Z |
ModifyDate: | 2019:10:04 06:32:00Z |
Template: | Normal |
TotalEditTime: | 8 minutes |
Pages: | 14 |
Words: | 4951 |
Characters: | 28223 |
Application: | Microsoft Office Word |
DocSecurity: | None |
Lines: | 235 |
Paragraphs: | 66 |
ScaleCrop: | No |
HeadingPairs: |
|
TitlesOfParts: | - |
Company: | - |
LinksUpToDate: | No |
CharactersWithSpaces: | 33108 |
SharedDoc: | No |
HyperlinksChanged: | No |
AppVersion: | 14 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2200 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\44ca56bc6b5ab5b825f95888e7d680c6_44ca56bc6b5ab5b825f95888e7d680c6(1).doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3784 | c:\Users\Public\ctrlpanel.exe | c:\Users\Public\ctrlpanel.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Control panel component Version: 1.0.0.0 | ||||
1552 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2200 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA89E.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2200 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\msoB279.tmp | — | |
MD5:— | SHA256:— | |||
1552 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRBB5B.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2200 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$ca56bc6b5ab5b825f95888e7d680c6_44ca56bc6b5ab5b825f95888e7d680c6(1).doc | pgc | |
MD5:3CE4678C943CE5709189192186DA2A49 | SHA256:97DE805C0994814BA1BB3575FD364041F0A642D74BAF51F9012023CF65264770 | |||
2200 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:F7B77449B13C2BEE090561117118F356 | SHA256:2367F2C9A271FFC240C0817994A811161A810518A6CA41026F0675C02A285AA9 | |||
2200 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryRU0419.lex | text | |
MD5:F3B25701FE362EC84616A93A45CE9998 | SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209 | |||
2200 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex | text | |
MD5:F3B25701FE362EC84616A93A45CE9998 | SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209 | |||
2200 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryUA0422.lex | text | |
MD5:F3B25701FE362EC84616A93A45CE9998 | SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209 | |||
2200 | WINWORD.EXE | C:\Users\Public\ctrlpanel.exe | executable | |
MD5:40D2CCD570BD898CC31AF1CBFE5FB08E | SHA256:10E720FBCF797A2F40FBAA214B3402DF14B7637404E5E91D7651BD13D28A69D8 |