File name: | 6e3409145d99f5d3bf14772427ba917ed0214d6f|invoice_519834.doc |
Full analysis: | https://app.any.run/tasks/c16e2c9b-c5fe-4a35-90f2-05efd28b3cc5 |
Verdict: | Malicious activity |
Threats: | Hancitor was created in 2014 to drop other malware on infected machines. It is also known as Tordal and Chanitor. This malware is available as a service which makes it accessible tools to criminals and contributes to the popularity of this virus. |
Analysis date: | December 06, 2018, 16:56:29 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
File info: | Microsoft Word 2007+ |
MD5: | 216272021F421D0222D1EAB86D362C1E |
SHA1: | 6E3409145D99F5D3BF14772427BA917ED0214D6F |
SHA256: | C1086F8F8C7600FC384E3FBDF89CEA316F6746C1D0D50DCDE2724679733F3343 |
SSDEEP: | 6144:tBpplRadx9txUgx6IOc0YBHldKruHv0TAyFuR+goXK:fpp6d5xUgnOytldTHv+uUK |
.docm | | | Word Microsoft Office Open XML Format document (with Macro) (53.6) |
---|---|---|
.docx | | | Word Microsoft Office Open XML Format document (24.2) |
.zip | | | Open Packaging Conventions container (18) |
.zip | | | ZIP compressed archive (4.1) |
Description: | - |
---|---|
Creator: | 444555 |
Subject: | - |
Title: |
ModifyDate: | 2018:12:06 14:02:00Z |
---|---|
CreateDate: | 2018:10:11 14:43:00Z |
RevisionNumber: | 343 |
LastModifiedBy: | user |
Keywords: | - |
AppVersion: | 15 |
HyperlinksChanged: | No |
SharedDoc: | No |
CharactersWithSpaces: | 20 |
LinksUpToDate: | No |
Company: | - |
TitlesOfParts: | |
HeadingPairs: |
|
ScaleCrop: | No |
Paragraphs: | 1 |
Lines: | 1 |
DocSecurity: | None |
Application: | Microsoft Office Word |
Characters: | 18 |
Words: | 3 |
Pages: | 1 |
TotalEditTime: | 8.4 hours |
Template: | Normal.dotm |
ZipFileName: | [Content_Types].xml |
---|---|
ZipUncompressedSize: | 2075 |
ZipCompressedSize: | 476 |
ZipCRC: | 0x112fb249 |
ZipModifyDate: | 1980:01:01 00:00:00 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0006 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2968 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\efb81a46-a6db-4f05-9ca1-ca3396958666.doc.docm" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
2744 | cmd.exe /c ping localhost -n 100 && C:\Users\admin\AppData\Local\Temp\6.pif | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3320 | ping localhost -n 100 | C:\Windows\system32\PING.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2260 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3472 | C:\Users\admin\AppData\Local\Temp\6.pif | C:\Users\admin\AppData\Local\Temp\6.pif | cmd.exe | |
User: admin Company: PostgreSQL Global Development Group Integrity Level: MEDIUM Description: initdb - initialize a new database cluster Version: 9.1.2 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2968 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA83A.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2968 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\5C.pif | — | |
MD5:— | SHA256:— | |||
2968 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~WRD0000.tmp | — | |
MD5:— | SHA256:— | |||
2968 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\81D98FC9.png | — | |
MD5:— | SHA256:— | |||
2968 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D474EC15-43CC-46B9-A169-BE006E381D8F}.tmp | — | |
MD5:— | SHA256:— | |||
2968 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E91EB0B1-4AE1-4197-92A0-BA5C3852708D}.tmp | — | |
MD5:— | SHA256:— | |||
2968 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFFFA29DCCA7D878FE.TMP | — | |
MD5:— | SHA256:— | |||
2968 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{14FDD902-DC1A-4EAA-8EF4-A54138A5EE4F}.tmp | — | |
MD5:— | SHA256:— | |||
2968 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:C9005899C42F58E9E7C96DCB3A5EE8E3 | SHA256:BAAA4B86601B2CDBDAF8C9D3F3076A6A57EBB0E5FFD49CF53E039A90105750E4 | |||
2968 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F4D864E8.emf | emf | |
MD5:F5F96F142A6CF7F55851B199434B2A2E | SHA256:C0854B82FCB45B6FD4FA3D689CA9308454427C4A56E1A5DB2BF865582571FB75 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3472 | 6.pif | GET | 404 | 54.204.36.156:80 | http://api.ipify.org/ | US | xml | 345 b | shared |
3472 | 6.pif | POST | 404 | 191.101.20.16:80 | http://tertsahedwith.com/4/forum.php | NL | xml | 345 b | malicious |
3472 | 6.pif | POST | 404 | 146.185.254.169:80 | http://howheidnot.ru/4/forum.php | RU | xml | 345 b | malicious |
3472 | 6.pif | POST | 404 | 191.101.20.16:80 | http://tertsahedwith.com/4/forum.php | NL | xml | 345 b | malicious |
3472 | 6.pif | POST | 404 | 146.185.254.169:80 | http://howheidnot.ru/4/forum.php | RU | xml | 345 b | malicious |
3472 | 6.pif | POST | 404 | 146.185.254.169:80 | http://dingtittohi.ru/4/forum.php | RU | xml | 345 b | malicious |
3472 | 6.pif | POST | 404 | 146.185.254.169:80 | http://dingtittohi.ru/4/forum.php | RU | xml | 345 b | malicious |
3472 | 6.pif | GET | 404 | 54.204.36.156:80 | http://api.ipify.org/ | US | xml | 345 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3472 | 6.pif | 146.185.254.169:80 | howheidnot.ru | MnogoByte LLC | RU | malicious |
3472 | 6.pif | 191.101.20.16:80 | tertsahedwith.com | Swiftway Sp. z o.o. | NL | malicious |
3472 | 6.pif | 54.204.36.156:80 | api.ipify.org | Amazon.com, Inc. | US | malicious |
Domain | IP | Reputation |
---|---|---|
api.ipify.org |
| shared |
tertsahedwith.com |
| malicious |
howheidnot.ru |
| malicious |
dingtittohi.ru |
| malicious |
dns.msftncsi.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
3472 | 6.pif | Potential Corporate Privacy Violation | ET POLICY External IP Lookup api.ipify.org |
3472 | 6.pif | A Network Trojan was detected | MALWARE [PTsecurity] Hancitor POST Data send |
3472 | 6.pif | A Network Trojan was detected | MALWARE [PTsecurity] Hancitor POST Data send |
3472 | 6.pif | A Network Trojan was detected | MALWARE [PTsecurity] Hancitor POST Data send |
3472 | 6.pif | A Network Trojan was detected | MALWARE [PTsecurity] Hancitor POST Data send |
3472 | 6.pif | A Network Trojan was detected | MALWARE [PTsecurity] Hancitor POST Data send |
3472 | 6.pif | A Network Trojan was detected | MALWARE [PTsecurity] Hancitor POST Data send |
3472 | 6.pif | Potential Corporate Privacy Violation | ET POLICY External IP Lookup api.ipify.org |
Process | Message |
---|---|
6.pif | gIpVG |