analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

FW Bill No 527331980.zip

Full analysis: https://app.any.run/tasks/06569fa0-5b34-4891-87a9-0f6392c2aa27
Verdict: Malicious activity
Analysis date: March 14, 2019, 14:58:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

6FBBD18F9A79C775BCF223EF7E6354BA

SHA1:

191244EDF40C3E5CD3038487A4321902F3FB2105

SHA256:

C42EA4C7EBB1CD9FB901FF2B220F28542595C2C042E81C4CA21C9C581A82ADDB

SSDEEP:

192:NZGe4ndGqvIZuDxSwBCMikP8/SGBBfRF3kmt:NsmZuD0pMiTL33ft

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 3752)

  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3752)

    • Starts Microsoft Office Application

      • WinRAR.exe (PID: 3460)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3752)

  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: FW Bill No 527331980.msg
ZipUncompressedSize: 32768
ZipCompressedSize: 7260
ZipCRC: 0x04efd25a
ZipModifyDate: 2018:03:07 10:44:15
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs outlook.exe winrar.exe no specs winrar.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3460"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\FW Bill No 527331980.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3752"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Rar$DIa3460.1326\FW Bill No 527331980.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
2620"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\XAK8UTLW\Bill 527331980.zip"C:\Program Files\WinRAR\WinRAR.exe—OUTLOOK.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3712"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\XAK8UTLW\Bill 527331980.zip"C:\Program Files\WinRAR\WinRAR.exe—OUTLOOK.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
Total events
2 976
Read events
2 522
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
26
Unknown types
2

Dropped files

PID
Process
Filename
Type
3752OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRA6F4.tmp.cvr —
MD5:—
SHA256:—
3752OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\XAK8UTLW\Bill 527331980 (2).zip\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
3752OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:9533EF5A614B1DF50F5EA7B9B0CB09C1
SHA256:393094E82863A8E9C0C8F0BCE8BC8983BB3522A534C474BB9E63D26F7AF74D56
3460WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3460.1326\FW Bill No 527331980.msgmsg
MD5:70EC0397D4FE94CA5FBC9A6B975CE91E
SHA256:18CB224FC4F8E58C1DA8D4A41BC5AC55019CCDCAD6FCD27601D1EE116AF86B72
2620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2620.4839\R716218917188.urltext
MD5:54540300CA3069BEECD6AB4920FA2D6D
SHA256:30828AACEB193B59CA7B52739A371DB5D880B6DE9F8A38F9D0EBA1BE89E02934
3752OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\XAK8UTLW\Bill 527331980.zipcompressed
MD5:5CA5B1DA691573E7E9C7CA4CA42AFA24
SHA256:DE0D75324F3C48C048A6B628A7BBCB6EB2B152ED1C8C9400B070E51383BABA75
2620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2620.3006\R716218917188.urltext
MD5:54540300CA3069BEECD6AB4920FA2D6D
SHA256:30828AACEB193B59CA7B52739A371DB5D880B6DE9F8A38F9D0EBA1BE89E02934
3752OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\XAK8UTLW\Bill 527331980 (2).zipcompressed
MD5:5CA5B1DA691573E7E9C7CA4CA42AFA24
SHA256:DE0D75324F3C48C048A6B628A7BBCB6EB2B152ED1C8C9400B070E51383BABA75
3752OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{3D213749-4131-4BF4-BB29-34700B806CCC}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:7D80C0A7E3849818695EAF4989186A3C
SHA256:72DC527D78A8E99331409803811CC2D287E812C008A1C869A6AEA69D7A44B597
3752OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_56056FC9B8F0D7408D13802F57A540F8.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3752
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3752
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
buyviagraoverthecounterusabb.net
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
FW Bill No 527331980.zip