analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

trojan_EvilDoc-IcedID.doc

Full analysis: https://app.any.run/tasks/252a33fd-c663-402f-a963-dead7203fc3a
Verdict: Malicious activity
Analysis date: June 27, 2022, 12:15:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

4A88E83B325AA23DA1E4BFA90B4F7C34

SHA1:

06F6DE4F48DBD69D8F8DD5FF1A33A8EEFFC94BAD

SHA256:

822A8E3DFA14CD7AAAC749DC0515C35CF20632717E191568BA5DAF137DB7EC17

SSDEEP:

3072:Ek8KJXyyyyyyyyyyyyyyyyyyy09JWQZs2wQ6I1W9m0N27L0Or1h0j6k+:EAJXyyyyyyyyyyyyyyyyyyy0vlZsXDIr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3064)

    • Drops executable file immediately after starts

      • WINWORD.EXE (PID: 3064)

    • Application was dropped or rewritten from another process

      • PFSDNSKDF.EXE (PID: 1372)

  • SUSPICIOUS

    • Reads the computer name

      • PFSDNSKDF.EXE (PID: 1372)

    • Checks supported languages

      • PFSDNSKDF.EXE (PID: 1372)

    • Drops a file with a compile date too recent

      • WINWORD.EXE (PID: 3064)

    • Executed via WMI

      • PFSDNSKDF.EXE (PID: 1372)

  • INFO

    • Checks supported languages

      • WINWORD.EXE (PID: 3064)

    • Reads mouse settings

      • WINWORD.EXE (PID: 3064)

    • Reads the computer name

      • WINWORD.EXE (PID: 3064)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3064)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docm | Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx | Word Microsoft Office Open XML Format document (24.2)
.zip | Open Packaging Conventions container (18)
.zip | ZIP compressed archive (4.1)

EXIF

XML

AppVersion: 14
HyperlinksChanged: No
SharedDoc: No
CharactersWithSpaces: 35
LinksUpToDate: No
Company: -
TitlesOfParts: -
HeadingPairs:
  • Название
  • 1
ScaleCrop: No
Paragraphs: 1
Lines: 1
DocSecurity: None
Application: Microsoft Office Word
Characters: 31
Words: 5
Pages: 2
TotalEditTime: -
Template: Normal.dotm
ModifyDate: 2020:05:19 12:23:00Z
CreateDate: 2020:05:11 15:09:00Z
RevisionNumber: 1
LastModifiedBy: -

XMP

Creator: -
Title: -

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1863
ZipCompressedSize: 479
ZipCRC: 0xa80c5040
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0006
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe pfsdnskdf.exe

Process information

PID
CMD
Path
Indicators
Parent process
3064"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\trojan_EvilDoc-IcedID.doc.docm"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
1372C:\1\Whole\PFSDNSKDF.EXEC:\1\Whole\PFSDNSKDF.EXE
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft SI/PSI parser for MPEG2 based networks.
Version:
6.6.7601.17669 (win7sp1_gdr.110816-1502)
Total events
3 382
Read events
2 114
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
3
Unknown types
4

Dropped files

PID
Process
Filename
Type
3064WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR4BF1.tmp.cvr —
MD5:—
SHA256:—
3064WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:D84FAB43953E7B63E96C2918B0240ECE
SHA256:6EB9B4CDDCEDCD95B521144819B0216FDE5C95372B9F5908D33F47A95C2DE58D
3064WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:5176404908C3AC0990D2789ADD512AEF
SHA256:18BD16173DC8D991E5F5DBEE1A9DE1A805477152C637C7A482DD20CE03F880C5
3064WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ojan_EvilDoc-IcedID.doc.docmpgc
MD5:58D07B9BFCC3C31CDABCB061AE0ACE45
SHA256:B8B1CE205D31260E1D62254798D92CB638C04881F2D6063855E379C396049567
3064WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\58169506.wmfimage
MD5:06D376F2B60912A61FBFBF77C04D018A
SHA256:4D023DE0C9F1BBA9D6E4FF1B45C5DCBB4732769BEE295E0F7A2B406B7DC01FAE
3064WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8EEDA1A3-65BA-41F8-8E20-9D7E0C6AD7EF}.tmpsmt
MD5:2C387924EF7B6BFCF56E19EC45D9811E
SHA256:0E8D078E2F8E50D21611BD82585B84F77277F278F98BE33D9FCFCBD89CC0D218
3064WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5E59DA38.wmfimage
MD5:3EE3DBB80AB8A06CAF51CB67AAF66C48
SHA256:410B4B4AE1191816B6FFBD3F97C866D806B1CAA3D02799CE2480F3EA10584E17
3064WINWORD.EXEC:\1\Whole\PFSDNSKDF.EXEexecutable
MD5:4C9C6B5B6DAA25B8DC274DD78FBC1AAA
SHA256:EE9FD78107CDCAFFC274CF2484D6C74C56C7F3BE39B1896894D9525506118D1E
3064WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E6FA64D9.datimage
MD5:42F3585D333FAEE5C435DF37883A54C7
SHA256:C4CAE3542DA5BA4F30A89591EEF07ED634C8334321D611E619B8A7CBC3CC792D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1372
PFSDNSKDF.EXE
104.125.72.97:443
support.apple.com
Akamai Technologies, Inc.
NL
unknown
1372
PFSDNSKDF.EXE
104.90.192.50:443
www.intel.com
Akamai Technologies, Inc.
NL
suspicious

DNS requests

Domain
IP
Reputation
support.apple.com
  • 104.125.72.97
whitelisted
www.intel.com
  • 104.90.192.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
trojan_EvilDoc-IcedID.doc