analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

bank_swift_01919.doc

Full analysis: https://app.any.run/tasks/8548cc41-58e0-47c9-a88a-e7331daa72aa
Verdict: Malicious activity
Analysis date: January 10, 2019, 18:49:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

57A0D337FF8BA6961771E112703E6FBB

SHA1:

79854DB5DEF4E6385CAE77941D21B197C4BC8021

SHA256:

781E73471902B00D5AAFEF5D2E085C458BDCD3BE2C6BBEB5397BAF413F4B99E0

SSDEEP:

6144:iXjXRXEXEXnXnXnXnXnXnXnXYXjXjXMXeXoXFoXKXNXmXYXH:Y7JKKXXXXXXXW77isGFGQtkWH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 3392)
  • SUSPICIOUS

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 3392)
  • INFO

    • Application was crashed

      • EQNEDT32.EXE (PID: 3392)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 2944)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

InternalVersionNumber: 24689
CharactersWithSpaces: 1773
Characters: 1511
Words: 265
Pages: 2
TotalEditTime: -
RevisionNumber: 2
LastPrinted: 2018:12:12 16:35:00
ModifyDate: 2018:12:14 09:22:00
CreateDate: 2018:12:14 09:22:00
LastModifiedBy: Windows User
Author: Mr.Duoc
Upr: {CH??NG TRÌNH }{*{CH{ƯƠNG TRÌNH }}}
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe no specs eqnedt32.exe

Process information

PID
CMD
Path
Indicators
Parent process
2944"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\bank_swift_01919.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3392"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Total events
1 119
Read events
726
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
2944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6AB1.tmp.cvr
MD5:
SHA256:
2944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$nk_swift_01919.docpgc
MD5:0E26ED925DA61E3B5DE1B10B82DFC2AE
SHA256:A58AA7C619D1CF4C17ADB995E9745A1D711E4F3FFCC6EA3DD0C66FE5DB1AB28E
3392EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@bit[1].txttext
MD5:1357DB6A5C60762F80679DF79B046CDD
SHA256:D7023AD417B107AFB031DDF36B1309CE7B19B8A4B83D76B0D7DC930A2714DB42
2944WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:C569802DB5849779F22174B9AB0F135F
SHA256:6C3CAD88468FE63910B07989B21F7D4FABE3C3BD098CFFAF6E32CA3A869558B7
3392EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3392
EQNEDT32.EXE
GET
301
67.199.248.10:80
http://bit.ly/2CYDJx8
US
html
115 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3392
EQNEDT32.EXE
67.199.248.10:80
bit.ly
Bitly Inc
US
shared

DNS requests

Domain
IP
Reputation
bit.ly
  • 67.199.248.10
  • 67.199.248.11
shared
daurn.tk
malicious

Threats

PID
Process
Class
Message
3392
EQNEDT32.EXE
A Network Trojan was detected
MALWARE [PTsecurity] PowerShell.Downloader httpHeader
No debug info