File name:

NUEVA ORDEN - NM049300 FERMAXIA-password(QKmLgls3).zip

Full analysis: https://app.any.run/tasks/2d543986-6846-409b-bc9d-82498f126a66
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 21:03:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
attachments
attc-unc
susp-attachments
stealer
agenttesla
ftp
exfiltration
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

45477E866DC304F06C3AE2C406B2BED1

SHA1:

D253C156CE77E1A28ABD5F87A42A06FB486A542B

SHA256:

845C7E0DBF037BC7528DCE1B3FB517DBDD584A3FDEB85E224069B7061F0F4883

SSDEEP:

98304:bjrTPmpBjzZOlbAYKuWIMSjWUO2CAGa3MvjO2roaiuhLBSjXSAN3b/RiFgEjsiM6:O6qSmEY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 5072)
      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 6156)
      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

    • Actions looks like stealing of personal data

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

    • Steals credentials from Web Browsers

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

    • AGENTTESLA has been detected (SURICATA)

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • WinRAR.exe (PID: 7364)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7364)
      • WinRAR.exe (PID: 5392)
      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

    • The process creates files with name similar to system file names

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 6156)
      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 5072)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 6156)
      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 5072)

    • Executable content was dropped or overwritten

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 6156)
      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 5072)

    • There is functionality for taking screenshot (YARA)

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 6156)

    • Executes application which crashes

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 5072)

    • Application launched itself

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 6156)

    • Connects to the server without a host name

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

    • Connects to FTP

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

    • Connects to unusual port

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

  • INFO

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 7364)

    • Checks supported languages

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 5072)
      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 6156)
      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

    • Reads the computer name

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 6156)
      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 5072)
      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

    • Create files in a temporary directory

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 6156)
      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 5072)

    • Checks proxy server information

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

    • Reads the machine GUID from the registry

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

    • Disables trace logs

      • Orden_NM049300 FERMAXIA.pdf.exe (PID: 7676)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7500)

    • Reads the software policy settings

      • slui.exe (PID: 7548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0801
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:17 20:58:56
ZipCRC: 0x00000000
ZipCompressedSize: 1754064
ZipUncompressedSize: 1754036
ZipFileName: a66e05684cd828e5a9b1771963a0121a13c7304a2a4037920dfb54d476575f9c.eml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
12
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe outlook.exe ai.exe no specs winrar.exe no specs orden_nm049300 fermaxia.pdf.exe orden_nm049300 fermaxia.pdf.exe werfault.exe no specs #AGENTTESLA orden_nm049300 fermaxia.pdf.exe svchost.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1388C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5072"C:\Users\admin\AppData\Local\Temp\Rar$EXa5392.14650\Orden_NM049300 FERMAXIA.pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5392.14650\Orden_NM049300 FERMAXIA.pdf.exe
WinRAR.exe
User:
admin
Company:
R.R. Donnelley & Sons Company
Integrity Level:
MEDIUM
Description:
ACT Manufacturing Inc.
Exit code:
3221225477
Version:
3.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5392.14650\orden_nm049300 fermaxia.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5392"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\35DF3V1S\Orden_NM049300 FERMAXIA.pdf.001"C:\Program Files\WinRAR\WinRAR.exe—OUTLOOK.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6156"C:\Users\admin\AppData\Local\Temp\Rar$EXa5392.13661\Orden_NM049300 FERMAXIA.pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5392.13661\Orden_NM049300 FERMAXIA.pdf.exe
WinRAR.exe
User:
admin
Company:
R.R. Donnelley & Sons Company
Integrity Level:
MEDIUM
Description:
ACT Manufacturing Inc.
Exit code:
0
Version:
3.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5392.13661\orden_nm049300 fermaxia.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
7012"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "9F09EE2E-B312-4E10-BCE8-22920467A975" "39441797-2E6A-461B-B26B-4DE0BFF62422" "7976"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
7364"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NUEVA ORDEN - NM049300 FERMAXIA-password(QKmLgls3).zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7500C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5072 -s 132C:\Windows\SysWOW64\WerFault.exe—Orden_NM049300 FERMAXIA.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7516C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7548"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
21 764
Read events
19 620
Write events
2 004
Delete events
140

Modification events

(PID) Process:(7364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\NUEVA ORDEN - NM049300 FERMAXIA-password(QKmLgls3).zip
(PID) Process:(7364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{5FA29220-36A1-40F9-89C6-F4B384B7642E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF
Value:
01000000000000009248B9246FC7DB01
Executable files
2
Suspicious files
20
Text files
21
Unknown types
0

Dropped files

PID
Process
Filename
Type
7976OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
7364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb7364.10660\a66e05684cd828e5a9b1771963a0121a13c7304a2a4037920dfb54d476575f9c.eml:OECustomPropertybinary
MD5:E73E334EC26BCBE52B32894E68513680
SHA256:90AA4D98ED3930924B435B01AA9938E0190F41983954D96667B647C02F2479D0
7364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb7364.10660\a66e05684cd828e5a9b1771963a0121a13c7304a2a4037920dfb54d476575f9c.emltext
MD5:911B986BBFAD904CA8481F54D6A30293
SHA256:A5402B71761D83B2BB8B91F6C56A522AA820DB06608464ED8D551976DAD6D8B1
5392WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5392.13661\Orden_NM049300 FERMAXIA.pdf.exe —
MD5:—
SHA256:—
7976OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B2C9B80E.datimage
MD5:5B33D248B42E8E1DD92D247FD37DB0C0
SHA256:9A9897FBAA4887C478674DDDECD582B99F25E0B143856A91FB2234F9936F304B
7976OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TableViewPreviewPrefs_2_10EFA01C406211479AB67E6890524605.datxml
MD5:0E092DB99AEE99FDFF9B5B222C732CFD
SHA256:D1614AD99ADED9F6F5C1BE7FE7FFA5124BD04A526580DA3818EA8A954E852AA6
7976OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\mso21FD.tmpimage
MD5:ED3C1C40B68BA4F40DB15529D5443DEC
SHA256:039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
7976OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
6156Orden_NM049300 FERMAXIA.pdf.exeC:\Users\admin\hundredfold\optativs\Uncontainableness\Waneatta\vikingetid\Sammenhftet.doi —
MD5:—
SHA256:—
7976OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:4F9DFB1E5D2AEDD2CB36EF04E270E2EF
SHA256:C1E27C4BF8F49638E9681E45BC9985DCCA0B208F0B0A90A71B0C87E3B73F4D5C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
34
DNS requests
23
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7976
OUTLOOK.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1188
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1188
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7976
OUTLOOK.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
7676
Orden_NM049300 FERMAXIA.pdf.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
7676
Orden_NM049300 FERMAXIA.pdf.exe
GET
200
75.127.7.164:80
http://75.127.7.164/phVcVwKV127.bin
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7976
OUTLOOK.EXE
52.109.76.240:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7976
OUTLOOK.EXE
52.123.129.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.25
  • 23.216.77.26
  • 23.216.77.31
  • 23.216.77.29
  • 23.216.77.37
  • 23.216.77.30
  • 23.216.77.32
  • 23.216.77.36
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.75
  • 20.190.159.130
  • 40.126.31.69
  • 20.190.159.68
  • 40.126.31.67
  • 20.190.159.23
  • 40.126.31.1
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
roaming.officeapps.live.com
  • 52.109.28.47
whitelisted

Threats

PID
Process
Class
Message
7676
Orden_NM049300 FERMAXIA.pdf.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
7676
Orden_NM049300 FERMAXIA.pdf.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7676
Orden_NM049300 FERMAXIA.pdf.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7676
Orden_NM049300 FERMAXIA.pdf.exe
A Network Trojan was detected
ET MALWARE AgentTesla Exfil via FTP
7676
Orden_NM049300 FERMAXIA.pdf.exe
Misc activity
INFO [ANY.RUN] FTP protocol command for uploading a file
7676
Orden_NM049300 FERMAXIA.pdf.exe
A Network Trojan was detected
STEALER [ANY.RUN] AgentTesla Exfiltration (raw TCP)
7676
Orden_NM049300 FERMAXIA.pdf.exe
A Network Trojan was detected
STEALER [ANY.RUN] AgentTesla Exfiltration (raw TCP)
7676
Orden_NM049300 FERMAXIA.pdf.exe
Misc activity
INFO [ANY.RUN] FTP server is ready for the new user
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NUEVA ORDEN - NM049300 FERMAXIA-password(QKmLgls3).zip