File name: | Como Importar de China - Aprende Paso a Paso de Manera Fácil Segura y Rápida - Enfoque 100% Práctico.msg |
Full analysis: | https://app.any.run/tasks/2aeb0c5b-48de-41c4-b356-7b55392411cb |
Verdict: | Malicious activity |
Analysis date: | December 06, 2019, 15:08:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 4E989C008CC3DCCB152D241ADCE5C42A |
SHA1: | 3E4B1C828F7C9301973AD863248AD5386686EC84 |
SHA256: | 4538DD60ED4CAA5031AA44BEE54E1051DD741AC89895597C108D17F036D9FC2A |
SSDEEP: | 768:54/4m9WsK6WsKkQhqnxDNhv8LcjVcfK5Ot0j7Yd3gYRWu6WsKJWsKehrK5IFu/5i:bOWCWmVkkOyjkdwYwWRWjmW5c |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2056 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\eec1f2e3-1cd8-4538-a56f-81fef2c7d24f.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
496 | "C:\Program Files\Internet Explorer\iexplore.exe" http://bit.ly/2Fh3WYN | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2676 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:496 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2056 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRE00F.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2676 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@whatsapp[1].txt | — | |
MD5:— | SHA256:— | |||
2056 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:323DE70FDBC7528C28EE81B2A408EFDF | SHA256:C3CBB4082B185530FA442E7022644E62F6206D5D61650B675B41D0D90906D2E0 | |||
2056 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:5608F57727282F5E03D27BDC33E44565 | SHA256:6FE387D31F7879AA6FE9EDBFD9AC14C59FD06B8DF2A21D24CF9B931EE63CB400 | |||
2676 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\95491OQP\send[1].txt | — | |
MD5:— | SHA256:— | |||
2676 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat | dat | |
MD5:5B8E073F5DDCBB773A06091B8EFDB2F1 | SHA256:E6149BD88679D146731855B6612967DA60BBA365B74A2323C2700312F3209721 | |||
2676 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:3718C1FEE691FB810652803365F675CC | SHA256:749CE691FF538C1E4F7245BDCE3DCB0CD1683A91236BF7522168332B11D55167 | |||
2056 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inf | text | |
MD5:48DD6CAE43CE26B992C35799FCD76898 | SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A | |||
2056 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ConversationPrefs_2_E1503A9F71EF634690B6E1BA78B4D159.dat | xml | |
MD5:57F30B1BCA811C2FCB81F4C13F6A927B | SHA256:612BAD93621991CB09C347FF01EC600B46617247D5C041311FF459E247D8C2D3 | |||
2056 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_1848BEAB35A2E141AD3C04D2B3A7E61B.dat | xml | |
MD5:BBCF400BD7AE536EB03054021D6A6398 | SHA256:383020065C1F31F4FB09F448599A6D5E532C390AF4E5B8AF0771FE17A23222AD |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2056 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
2676 | iexplore.exe | GET | 301 | 67.199.248.11:80 | http://bit.ly/2Fh3WYN | US | html | 112 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
496 | iexplore.exe | 185.60.216.19:443 | static.xx.fbcdn.net | Facebook, Inc. | IE | whitelisted |
496 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2676 | iexplore.exe | 67.199.248.11:80 | bit.ly | Bitly Inc | US | shared |
2676 | iexplore.exe | 108.168.255.227:443 | wa.me | SoftLayer Technologies Inc. | US | unknown |
2676 | iexplore.exe | 185.60.216.53:443 | api.whatsapp.com | Facebook, Inc. | IE | whitelisted |
2056 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2676 | iexplore.exe | 185.60.216.19:443 | static.xx.fbcdn.net | Facebook, Inc. | IE | whitelisted |
2676 | iexplore.exe | 31.13.64.21:443 | scontent-amt2-1.xx.fbcdn.net | Facebook, Inc. | IE | whitelisted |
2676 | iexplore.exe | 69.171.250.54:443 | static.whatsapp.net | Facebook, Inc. | US | unknown |
496 | iexplore.exe | 69.171.250.54:443 | static.whatsapp.net | Facebook, Inc. | US | unknown |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
bit.ly |
| shared |
wa.me |
| whitelisted |
www.bing.com |
| whitelisted |
api.whatsapp.com |
| whitelisted |
static.xx.fbcdn.net |
| whitelisted |
www.whatsapp.com |
| suspicious |
static.whatsapp.net |
| whitelisted |
web.whatsapp.com |
| whitelisted |
scontent-amt2-1.xx.fbcdn.net |
| whitelisted |