File name: | Fwd Re .msg |
Full analysis: | https://app.any.run/tasks/05496a3e-85b6-49f4-972a-9c7d78616428 |
Verdict: | Malicious activity |
Analysis date: | November 14, 2018, 08:30:34 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 8AD822F059AF0668D51A728C91A847DF |
SHA1: | B2937AFF0A6476CE26E6A9642F57323A22A92E3B |
SHA256: | 9CAD51885040EB4D72FB4593157A9D4C6FF6172272F1A083E5F219296885E049 |
SSDEEP: | 768:/U/iUHbnAfzAygGRbJ8S50GykAAiNgNkWwGE:y495 |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2816 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Fwd Re .msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
2168 | "C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?ei=cVz-w8gmnus1BBTUzcgPy37sYPxSSa9yxc7&gs_l=mz12x2pqdrp7td2x | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3644 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2168 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
316 | "C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?ei=cVz-w8gmnus1BBTUzcgPy37sYPxSSa9yxc7&gs_l=mz12x2pqdrp7td2x | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2112 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:316 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
360 | "C:\Program Files\Internet Explorer\iexplore.exe" https://goo.gl/XQfFdG | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3080 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:360 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2164 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:360 CREDAT:203009 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2816 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR9585.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2168 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2168 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF8495DE78A865AC8B.TMP | — | |
MD5:— | SHA256:— | |||
2816 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:7FB71477B237DEF2B856A0141EDC7FC5 | SHA256:CFC8C4281AAE6E3EB16CCF5BDF256EB978644D4F8424DE97D466A7338EE70C2D | |||
2168 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF7054E0B2872C0528.TMP | — | |
MD5:— | SHA256:— | |||
3644 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\recaptcha__en[1].js | text | |
MD5:A93F299ABBA65F36BA2E4018227C5CCB | SHA256:DD86315D28C41239627E235A9CAD43E0A2AB155AB6E639C06F5237F166D567F5 | |||
3644 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@google[2].txt | text | |
MD5:D4B92622C067EBEDA6A3CEB841B0668B | SHA256:BCFA289E57D2380BF9CD727190F25FA5C3BFBE713EA51F470EDDD9B7DDB52BEA | |||
2168 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFDA2A8AE131618176.TMP | — | |
MD5:— | SHA256:— | |||
2168 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{9DFC7152-E7E7-11E8-BFAB-5254004AAD11}.dat | — | |
MD5:— | SHA256:— | |||
3644 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@google[3].txt | text | |
MD5:23B71C24FC7B56CD9CA5BA440C0E2B33 | SHA256:2EDECDD240BA9607DF882B4D54D6289B74168DEF3C414C352B8F5BDF40CC09CC |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2816 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
316 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
360 | iexplore.exe | GET | 200 | 94.199.178.60:80 | http://disztorta.hu/favicon.ico | HU | — | — | unknown |
3080 | iexplore.exe | GET | 200 | 94.199.178.60:80 | http://disztorta.hu/szab/rend/doc/contactswc/relateform/affiliate_help8/outnet-tipsar.php?action=hmmt102tkw0u4w | HU | html | 1.23 Kb | unknown |
360 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2168 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
360 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2164 | iexplore.exe | GET | 301 | 38.132.114.165:80 | http://keto-purefitbody.com/keto_int/?click_id=11_27791355_4d29989e-3f93-4fb3-bf7f-a171ac5c06d5&subid1=418240&netid=3&ver=old&ad=1mvx | US | html | 178 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2816 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2168 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3644 | iexplore.exe | 216.58.215.227:443 | www.gstatic.com | Google Inc. | US | whitelisted |
2112 | iexplore.exe | 216.58.215.228:443 | www.google.com | Google Inc. | US | whitelisted |
3644 | iexplore.exe | 216.58.215.228:443 | www.google.com | Google Inc. | US | whitelisted |
2168 | iexplore.exe | 216.58.215.228:443 | www.google.com | Google Inc. | US | whitelisted |
316 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2112 | iexplore.exe | 216.58.215.227:443 | www.gstatic.com | Google Inc. | US | whitelisted |
3080 | iexplore.exe | 172.217.168.14:443 | goo.gl | Google Inc. | US | whitelisted |
360 | iexplore.exe | 94.199.178.60:80 | disztorta.hu | EZIT Kft. | HU | unknown |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
www.google.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
goo.gl |
| shared |
disztorta.hu |
| unknown |
fastdietline.net |
| unknown |
code.jquery.com |
| whitelisted |
keto-purefitbody.com |
| unknown |
fonts.googleapis.com |
| whitelisted |