File name:

trojan_EvilDoc-IcedID.doc

Full analysis: https://app.any.run/tasks/252a33fd-c663-402f-a963-dead7203fc3a
Verdict: Malicious activity
Analysis date: June 27, 2022, 12:15:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

4A88E83B325AA23DA1E4BFA90B4F7C34

SHA1:

06F6DE4F48DBD69D8F8DD5FF1A33A8EEFFC94BAD

SHA256:

822A8E3DFA14CD7AAAC749DC0515C35CF20632717E191568BA5DAF137DB7EC17

SSDEEP:

3072:Ek8KJXyyyyyyyyyyyyyyyyyyy09JWQZs2wQ6I1W9m0N27L0Or1h0j6k+:EAJXyyyyyyyyyyyyyyyyyyy0vlZsXDIr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WINWORD.EXE (PID: 3064)

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3064)

    • Application was dropped or rewritten from another process

      • PFSDNSKDF.EXE (PID: 1372)

  • SUSPICIOUS

    • Drops a file with a compile date too recent

      • WINWORD.EXE (PID: 3064)

    • Executed via WMI

      • PFSDNSKDF.EXE (PID: 1372)

    • Reads the computer name

      • PFSDNSKDF.EXE (PID: 1372)

    • Checks supported languages

      • PFSDNSKDF.EXE (PID: 1372)

  • INFO

    • Reads the computer name

      • WINWORD.EXE (PID: 3064)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3064)

    • Checks supported languages

      • WINWORD.EXE (PID: 3064)

    • Reads mouse settings

      • WINWORD.EXE (PID: 3064)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docm | Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx | Word Microsoft Office Open XML Format document (24.2)
.zip | Open Packaging Conventions container (18)
.zip | ZIP compressed archive (4.1)

EXIF

XML

AppVersion: 14
HyperlinksChanged: No
SharedDoc: No
CharactersWithSpaces: 35
LinksUpToDate: No
Company: -
TitlesOfParts: -
HeadingPairs:
  • Название
  • 1
ScaleCrop: No
Paragraphs: 1
Lines: 1
DocSecurity: None
Application: Microsoft Office Word
Characters: 31
Words: 5
Pages: 2
TotalEditTime: -
Template: Normal.dotm
ModifyDate: 2020:05:19 12:23:00Z
CreateDate: 2020:05:11 15:09:00Z
RevisionNumber: 1
LastModifiedBy: -

XMP

Creator: -
Title: -

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1863
ZipCompressedSize: 479
ZipCRC: 0xa80c5040
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0006
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe pfsdnskdf.exe

Process information

PID
CMD
Path
Indicators
Parent process
1372C:\1\Whole\PFSDNSKDF.EXEC:\1\Whole\PFSDNSKDF.EXE
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft SI/PSI parser for MPEG2 based networks.
Exit code:
0
Version:
6.6.7601.17669 (win7sp1_gdr.110816-1502)
Modules
Images
c:\1\whole\pfsdnskdf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
3064"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\trojan_EvilDoc-IcedID.doc.docm"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
Total events
3 382
Read events
2 114
Write events
694
Delete events
574

Modification events

(PID) Process:(3064) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:qw?
Value:
71773F00F80B0000010000000000000000000000
(PID) Process:(3064) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3064) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(3064) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(3064) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(3064) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(3064) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(3064) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(3064) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(3064) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
1
Suspicious files
0
Text files
3
Unknown types
4

Dropped files

PID
Process
Filename
Type
3064WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR4BF1.tmp.cvr —
MD5:—
SHA256:—
3064WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ojan_EvilDoc-IcedID.doc.docmpgc
MD5:—
SHA256:—
3064WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:—
SHA256:—
3064WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:—
SHA256:—
3064WINWORD.EXEC:\1\Whole\PFSDNSKDF.EXEexecutable
MD5:4C9C6B5B6DAA25B8DC274DD78FBC1AAA
SHA256:EE9FD78107CDCAFFC274CF2484D6C74C56C7F3BE39B1896894D9525506118D1E
3064WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5E59DA38.wmfimage
MD5:3EE3DBB80AB8A06CAF51CB67AAF66C48
SHA256:410B4B4AE1191816B6FFBD3F97C866D806B1CAA3D02799CE2480F3EA10584E17
3064WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\58169506.wmfimage
MD5:06D376F2B60912A61FBFBF77C04D018A
SHA256:4D023DE0C9F1BBA9D6E4FF1B45C5DCBB4732769BEE295E0F7A2B406B7DC01FAE
3064WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E6FA64D9.datimage
MD5:42F3585D333FAEE5C435DF37883A54C7
SHA256:C4CAE3542DA5BA4F30A89591EEF07ED634C8334321D611E619B8A7CBC3CC792D
3064WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8EEDA1A3-65BA-41F8-8E20-9D7E0C6AD7EF}.tmpsmt
MD5:2C387924EF7B6BFCF56E19EC45D9811E
SHA256:0E8D078E2F8E50D21611BD82585B84F77277F278F98BE33D9FCFCBD89CC0D218
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1372
PFSDNSKDF.EXE
104.125.72.97:443
support.apple.com
Akamai Technologies, Inc.
NL
unknown
1372
PFSDNSKDF.EXE
104.90.192.50:443
www.intel.com
Akamai Technologies, Inc.
NL
suspicious

DNS requests

Domain
IP
Reputation
support.apple.com
  • 104.125.72.97
whitelisted
www.intel.com
  • 104.90.192.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
trojan_EvilDoc-IcedID.doc