File name: | Documentation du 22 09.zip |
Full analysis: | https://app.any.run/tasks/d9d1be16-1c9c-40d1-a1b8-f03b3ff0129b |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | September 30, 2020, 06:24:22 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v5.1 to extract |
MD5: | 35D9B1E306A5A197EC83A6A32EA6B27E |
SHA1: | D3DB32EE53E4436AD4ABFC8C69ED492A062B8CBB |
SHA256: | 3E150F3EFC4F2678D31FD5A727A8AD6F93D9A829F922404490469A78FD44AC1E |
SSDEEP: | 1536:ex7pvAWECTfipT9QBeD+zhsq8I1Kitcuy8n3YIuOl/+fayNTKvZsLD:mdvXTqpT9Qk+syKitn3JNl3yNT6ZO |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 51 |
---|---|
ZipBitFlag: | 0x0003 |
ZipCompression: | Unknown (99) |
ZipModifyDate: | 2020:09:22 16:44:00 |
ZipCRC: | 0x7db14635 |
ZipCompressedSize: | 78766 |
ZipUncompressedSize: | 165036 |
ZipFileName: | Information du 2209.doc |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2624 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Documentation du 22 09.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
1544 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb2624.41436\Information du 2209.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1544 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR2B86.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1544 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:6595E94BA994DC86FEF85ECFDD64899F | SHA256:94038141288D7C93B6DE4284EE6095C9BEBFF68A612D358196C9C99F63E13E31 | |||
1544 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Rar$DIb2624.41436\~$formation du 2209.doc | pgc | |
MD5:0D612B089B5A52E922CA89A4CD773511 | SHA256:94EB1586C6570E8DD713088D6C5B101565937545EACC480154A0CA4B4FF97A54 | |||
2624 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb2624.41436\Information du 2209.doc | document | |
MD5:117A110D941BE98B0C800D7ACD0A9472 | SHA256:4261E0A59F6233828BBAAE55E703E776ECF7B9E92337D81ACBC98F9389A8C85D |