File name:

PO 2021080091.docx

Full analysis: https://app.any.run/tasks/2610ac7d-7db8-4ec3-80c3-5bd0b50b0f88
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 18, 2021, 07:14:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
exploit
cve-2017-11882
loader
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

23D53EBB7648956601DA160BA97ADBB6

SHA1:

DE25E810459CBCE7DD7F70ADF0A3923839D52614

SHA256:

32F7DEF073D4145DF12DA7B14DBD79B33B85E62A09B23E1643EF84379ACE48ED

SSDEEP:

192:ScIMmtPi95kG/bGv7m7sOxVrf0krFnuTE3qZf:SPXIBGv7jOxV7lrFnuIa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 1196)

    • Drops executable file immediately after starts

      • EQNEDT32.EXE (PID: 1196)

    • Application was dropped or rewritten from another process

      • vbc.exe (PID: 3364)

  • SUSPICIOUS

    • Executed via COM

      • EQNEDT32.EXE (PID: 1196)

    • Drops a file with too old compile date

      • EQNEDT32.EXE (PID: 1196)

    • Reads the computer name

      • EQNEDT32.EXE (PID: 1196)
      • vbc.exe (PID: 3364)

    • Checks supported languages

      • vbc.exe (PID: 3364)
      • EQNEDT32.EXE (PID: 1196)

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 1196)

  • INFO

    • Checks supported languages

      • WINWORD.EXE (PID: 456)

    • Reads the computer name

      • WINWORD.EXE (PID: 456)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 456)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1312
ZipCompressedSize: 358
ZipCRC: 0x3795fcdd
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0006
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winword.exe eqnedt32.exe vbc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\PO 2021080091.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
1196"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3364"C:\Users\Public\vbc.exe" C:\Users\Public\vbc.exe—EQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
PokerGame
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\public\vbc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
3 102
Read events
2 750
Write events
172
Delete events
180

Modification events

(PID) Process:(456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName::x8
Value:
3A783800C8010000010000000000000000000000
(PID) Process:(456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
2
Suspicious files
9
Text files
5
Unknown types
2

Dropped files

PID
Process
Filename
Type
456WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRF43A.tmp.cvr —
MD5:—
SHA256:—
456WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ 2021080091.docxpgc
MD5:—
SHA256:—
456WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\invoice on 103.155.80.150.urltext
MD5:—
SHA256:—
456WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\67B89BD8.wbktext
MD5:—
SHA256:—
456WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{E600368C-7BA9-436F-8B06-E69FBE1C1B07}binary
MD5:—
SHA256:—
456WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\dsf[1].wbktext
MD5:—
SHA256:—
1196EQNEDT32.EXEC:\Users\Public\vbc.exeexecutable
MD5:—
SHA256:—
1196EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\vbc[1].exeexecutable
MD5:—
SHA256:—
456WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:—
SHA256:—
456WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\awq3lk.urltext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
7
DNS requests
1
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
456
WINWORD.EXE
HEAD
200
103.155.80.150:80
http://103.155.80.150/invoice/dsf.wbk
unknown
—
—
malicious
456
WINWORD.EXE
HEAD
302
52.138.218.121:80
http://cml.lol/awq3lk
IE
—
—
suspicious
840
svchost.exe
OPTIONS
200
52.138.218.121:80
http://cml.lol/
IE
html
2.85 Kb
suspicious
1196
EQNEDT32.EXE
GET
200
103.155.80.150:80
http://103.155.80.150/kfc/vbc.exe
unknown
executable
400 Kb
malicious
456
WINWORD.EXE
HEAD
200
103.155.80.150:80
http://103.155.80.150/invoice/dsf.wbk
unknown
text
13.4 Kb
malicious
456
WINWORD.EXE
GET
302
52.138.218.121:80
http://cml.lol/awq3lk
IE
html
154 b
suspicious
456
WINWORD.EXE
OPTIONS
200
52.138.218.121:80
http://cml.lol/
IE
html
2.85 Kb
suspicious
456
WINWORD.EXE
HEAD
302
52.138.218.121:80
http://cml.lol/awq3lk
IE
html
154 b
suspicious
840
svchost.exe
PROPFIND
200
52.138.218.121:80
http://cml.lol/
IE
html
2.85 Kb
suspicious
456
WINWORD.EXE
GET
200
103.155.80.150:80
http://103.155.80.150/invoice/dsf.wbk
unknown
text
13.4 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
456
WINWORD.EXE
52.138.218.121:80
cml.lol
Microsoft Corporation
IE
suspicious
840
svchost.exe
52.138.218.121:80
cml.lol
Microsoft Corporation
IE
suspicious
456
WINWORD.EXE
103.155.80.150:80
—
—
—
malicious
1196
EQNEDT32.EXE
103.155.80.150:80
—
—
—
malicious

DNS requests

Domain
IP
Reputation
cml.lol
  • 52.138.218.121
suspicious

Threats

PID
Process
Class
Message
456
WINWORD.EXE
Potentially Bad Traffic
ET POLICY [@Silv0123] Possible Fake Microsoft Office User-Agent Observed
456
WINWORD.EXE
Potentially Bad Traffic
ET POLICY [@Silv0123] Possible Fake Microsoft Office User-Agent Observed
456
WINWORD.EXE
Potentially Bad Traffic
ET POLICY [@Silv0123] Possible Fake Microsoft Office User-Agent Observed
456
WINWORD.EXE
Potentially Bad Traffic
ET POLICY [@Silv0123] Possible Fake Microsoft Office User-Agent Observed
456
WINWORD.EXE
Potentially Bad Traffic
ET INFO Possible RTF File With Obfuscated Version Header
456
WINWORD.EXE
Potentially Bad Traffic
ET POLICY [@Silv0123] Possible Fake Microsoft Office User-Agent Observed
1196
EQNEDT32.EXE
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
1196
EQNEDT32.EXE
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
1196
EQNEDT32.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
1196
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PO 2021080091.docx