analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Purchase Order Ref. 33-076641.doc

Full analysis: https://app.any.run/tasks/d1f83ce4-ad7b-416c-80e2-c4ee8e499249
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: March 31, 2020, 11:12:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
exploit
CVE-2017-11882
loader
rat
agenttesla
Indicators:
MIME: text/rtf
File info: Rich Text Format data, unknown version
MD5:

6565967391AE7F0BD516507D9AF0C32C

SHA1:

BA56B660D45B012D39768D5AE22A8CC893D37377

SHA256:

55F21E30307207AAA2B2AAD1EC0793A4DE9DCB211A4DD637840CF7F577379061

SSDEEP:

1536:O20K07W5UKwHXqXBNP81ba9MDL24PI/XAXWocW+oGz6nJCS0DOKdYaVJQWWPmMTw:yKkyV4PmWapdYkJWPmMTo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 2404)
    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2404)
    • Application was dropped or rewritten from another process

      • macx.com (PID: 1352)
    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 2404)
    • Actions looks like stealing of personal data

      • macx.com (PID: 1352)
    • AGENTTESLA was detected

      • macx.com (PID: 1352)
  • SUSPICIOUS

    • Creates files in the program directory

      • EQNEDT32.EXE (PID: 2404)
    • Executed via COM

      • EQNEDT32.EXE (PID: 2404)
    • Starts application with an unusual extension

      • EQNEDT32.EXE (PID: 2404)
    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 2404)
    • Connects to SMTP port

      • macx.com (PID: 1352)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1720)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 1720)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe #AGENTTESLA macx.com

Process information

PID
CMD
Path
Indicators
Parent process
1720"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Purchase Order Ref. 33-076641.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2404"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
1352"C:\ProgramData\macx.com"C:\ProgramData\macx.com
EQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Total events
1 604
Read events
936
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
1720WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6B16.tmp.cvr
MD5:
SHA256:
1720WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:AD0B5B1B6B82BB643D1F6014B3170A7D
SHA256:C963897B81CA00D5A7F3E288E2128F74DEA26D42A41B5E5FE63958E673C7F6B0
1720WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$rchase Order Ref. 33-076641.doc.rtfpgc
MD5:1E578007128737630E8D7C138675CDEA
SHA256:52D424EF02CA2DCCF4882ADD7788E07E89C29A51AF23A5EBB0297F9F6E6DF8A2
2404EQNEDT32.EXEC:\ProgramData\macx.comexecutable
MD5:20C72033D7CF9B53141537B8DB199A93
SHA256:2E38848821412AB5A878A0E2C5A004AA34DBA2266D38083C95A26D6BE9F588C0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2404
EQNEDT32.EXE
GET
200
156.67.213.212:80
http://autodidak.net/old/wp-content/plugins/pagelayer/images/frr.exe
SG
executable
290 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2404
EQNEDT32.EXE
156.67.213.212:80
autodidak.net
Hostinger International Limited
SG
malicious
1352
macx.com
208.91.199.224:587
smtp.zeyiti-sa.com
PDR
US
shared

DNS requests

Domain
IP
Reputation
autodidak.net
  • 156.67.213.212
suspicious
smtp.zeyiti-sa.com
  • 208.91.199.224
  • 208.91.199.223
  • 208.91.199.225
  • 208.91.198.143
malicious

Threats

PID
Process
Class
Message
2404
EQNEDT32.EXE
A Network Trojan was detected
ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious
2404
EQNEDT32.EXE
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
2404
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2404
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1352
macx.com
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
1352
macx.com
A Network Trojan was detected
SPYWARE [PTsecurity] AgentTesla Exfiltration
No debug info