analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PI No.40910047.doc

Full analysis: https://app.any.run/tasks/acb3e6c4-ab7e-47d3-abcd-b293b58d73c0
Verdict: Malicious activity
Analysis date: November 08, 2018, 13:27:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF, CR line terminators, with escape sequences
MD5:

8F6E4F33FF1580F1F68B9F4541E2BE67

SHA1:

673BBDA3F879B1248E97476A471F6F6362905F09

SHA256:

87FD60143A7073335686F785FB8032E90FE33E30542E72912C63046A49FC3572

SSDEEP:

1536:Z8Yz8Y18Yc8Yc8Yv8Yv8Yv8Yv8Yv8Yv8Yv8YI8Yz8Yz8Yz8YPsu0AWnuFv7hq:Z828k81818S8S8S8S8S8S8S8h828282S

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 920)

  • SUSPICIOUS

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 920)

  • INFO

    • Application was crashed

      • EQNEDT32.EXE (PID: 920)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3208)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs eqnedt32.exe

Process information

PID
CMD
Path
Indicators
Parent process
3208"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\PI No.40910047.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
920"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Total events
1 241
Read events
833
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
1
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
3208WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR91DB.tmp.cvr —
MD5:—
SHA256:—
920EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@bit[1].txttext
MD5:F2FBF0E5898FE018F2DE47E1605D8ACF
SHA256:3321B11029D000FB1CA4A44BC370C0F1D0963CE68C70676D0A3FFDCB69BA0FA7
3208WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:59131AE46194C72AAA2801E1AD2642A0
SHA256:32C5BFAA5D065DD7FD36D9AD6A40361A8160F42BB4F98F164D4D8BCB0E92CEE3
3208WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ No.40910047.docpgc
MD5:E3E0DD5D81098A2D04F819817BDE4881
SHA256:054C649EF870C7A6596CD4D03085F2A531818A9A21BE8005EFF222761AEE92FE
920EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E02357FC7708441D4B0BE5F371F4B28961870F70binary
MD5:DA6C793FB0533AF0139A6D76C9956547
SHA256:BCEC4BFFD8EE03E0FDF1C1577EF4635AC08DB1F94CF07B0C406A6B3A171E9E1D
920EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
920
EQNEDT32.EXE
GET
301
67.199.248.10:80
http://bit.ly/2yRu1u3
US
html
116 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
920
EQNEDT32.EXE
67.199.248.10:80
bit.ly
Bitly Inc
US
shared
920
EQNEDT32.EXE
185.83.214.16:443
a.doko.moe
—
PT
suspicious

DNS requests

Domain
IP
Reputation
bit.ly
  • 67.199.248.10
  • 67.199.248.11
shared
a.doko.moe
  • 185.83.214.16
unknown

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PI No.40910047.doc