File name: | sample.doc |
Full analysis: | https://app.any.run/tasks/c2288866-9036-4b9f-8dfa-9019000d2ade |
Verdict: | Malicious activity |
Analysis date: | June 27, 2022, 11:02:10 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/octet-stream |
File info: | Microsoft OOXML |
MD5: | 52945AF1DEF85B171870B31FA4782E52 |
SHA1: | 06727FFDA60359236A8029E0B3E8A0FD11C23313 |
SHA256: | 4A24048F81AFBE9FB62E7A6A49ADBD1FAF41F266B5F9FEECDCEB567AEC096784 |
SSDEEP: | 192:AEhM7fIUU09264wptGheab8h7Z/c+8poF1d3jvvtl59rGxjPQDasYBcG7h+:AqWfIz092hwLGAabkcfa7pr1lzyxjPQ9 |
.docx | | | Word Microsoft Office Open XML Format document (52.2) |
---|---|---|
.zip | | | Open Packaging Conventions container (38.8) |
.zip | | | ZIP compressed archive (8.8) |
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | Deflated |
ZipModifyDate: | 2022:05:26 23:08:07 |
ZipCRC: | 0x6cd2a4df |
ZipCompressedSize: | 340 |
ZipUncompressedSize: | 1312 |
ZipFileName: | [Content_Types].xml |
Template: | Normal |
---|---|
TotalEditTime: | - |
Pages: | 1 |
Words: | - |
Characters: | - |
Application: | Microsoft Office Word |
DocSecurity: | None |
Lines: | - |
Paragraphs: | - |
ScaleCrop: | No |
Company: | - |
LinksUpToDate: | No |
CharactersWithSpaces: | - |
SharedDoc: | No |
HyperlinksChanged: | No |
AppVersion: | 16 |
Keywords: | - |
LastModifiedBy: | KIS2 |
RevisionNumber: | 3 |
CreateDate: | 2022:05:25 13:14:00Z |
ModifyDate: | 2022:05:25 13:14:00Z |
Title: | - |
---|---|
Subject: | - |
Creator: | KIS2 |
Description: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1000 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\sample.doc.docx" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | Explorer.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1000 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR9580.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1000 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$mple.doc.docx | pgc | |
MD5:7C39EDF5D339B847DE3E2342547BE5D7 | SHA256:FC37141674BF0E909C5C436335D3B08DC5606CCB53677E2F3C54A527A6B9A3B0 | |||
1000 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:B441B146E56E2764ACFA116FEB4866A1 | SHA256:1188F9CD73576F14D8F7FB06ED609FE6FF35E870BE52D5DBF85CE39D42CD1F02 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1000 | WINWORD.EXE | 23.217.138.108:443 | www.xmlformats.com | Akamai Technologies, Inc. | US | whitelisted |
1000 | WINWORD.EXE | 23.202.231.167:443 | www.xmlformats.com | Akamai Technologies, Inc. | US | malicious |
Domain | IP | Reputation |
---|---|---|
www.xmlformats.com |
| malicious |