File name: | Documentation du 22 09.zip |
Full analysis: | https://app.any.run/tasks/e2d90ecb-795c-4636-8cd2-cacb46f8f641 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | September 30, 2020, 06:26:41 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v5.1 to extract |
MD5: | 35D9B1E306A5A197EC83A6A32EA6B27E |
SHA1: | D3DB32EE53E4436AD4ABFC8C69ED492A062B8CBB |
SHA256: | 3E150F3EFC4F2678D31FD5A727A8AD6F93D9A829F922404490469A78FD44AC1E |
SSDEEP: | 1536:ex7pvAWECTfipT9QBeD+zhsq8I1Kitcuy8n3YIuOl/+fayNTKvZsLD:mdvXTqpT9Qk+syKitn3JNl3yNT6ZO |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | Information du 2209.doc |
---|---|
ZipUncompressedSize: | 165036 |
ZipCompressedSize: | 78766 |
ZipCRC: | 0x7db14635 |
ZipModifyDate: | 2020:09:22 16:44:00 |
ZipCompression: | Unknown (99) |
ZipBitFlag: | 0x0003 |
ZipRequiredVersion: | 51 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2648 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Documentation du 22 09.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3324 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb2648.5408\Information du 2209.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3324 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR7233.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2648 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb2648.5408\Information du 2209.doc | document | |
MD5:117A110D941BE98B0C800D7ACD0A9472 | SHA256:4261E0A59F6233828BBAAE55E703E776ECF7B9E92337D81ACBC98F9389A8C85D | |||
3324 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:A71B80287559ABF0E7CB2F3F90374D1E | SHA256:02E1E237FDE2741CE5AD3EFC6C445561E384C46F01E27F65FAA0A27C8F51E42E | |||
3324 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Rar$DIb2648.5408\~$formation du 2209.doc | pgc | |
MD5:B36F74CF36EA1DBE32B8DF02095BB33F | SHA256:2D53FA914B5B07D716A9997B7ED7C8E67202AC4EB068FDA2A38045D141AB4FF9 |