File name: | Invoice#1912103.doc |
Full analysis: | https://app.any.run/tasks/a4f38f8b-7d7b-4a8c-bc37-793915dd6211 |
Verdict: | Malicious activity |
Threats: | LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals. |
Analysis date: | February 19, 2019, 10:36:25 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | FF9D969AAEE14D691CBCAA400131696E |
SHA1: | 8DCB63B7F5E5F8D63D94CA57096DF56B5E749D32 |
SHA256: | CCF02B5E186A75C252DD4B96E8B02CC24F37280891F056263D7DF326CCC9ED21 |
SSDEEP: | 12288:RXeweMelbYAotcEbQl9yQNua4Wdp4echCknW8VX1ywrsxkXPeWBG3/9H9Kn2GxNp:RXeweMelMAowdtchphX17xeWBGXK2GjJ |
.rtf | | | Rich Text Format (100) |
---|
Author: | wuyan |
---|---|
LastModifiedBy: | wuyan |
CreateDate: | 2019:01:03 16:14:00 |
ModifyDate: | 2019:01:03 16:34:00 |
RevisionNumber: | 3 |
TotalEditTime: | 1 minute |
Pages: | 1 |
Words: | 4 |
Characters: | 24 |
CharactersWithSpaces: | 27 |
InternalVersionNumber: | 57435 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3508 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Roaming\Invoice#1912103.doc.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
2372 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
3072 | CmD /c %tMp%\A.R | C:\Windows\system32\CmD.exe | — | EQNEDT32.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3528 | C:\Users\admin\AppData\Local\Temp\A.R | C:\Users\admin\AppData\Local\Temp\A.R | CmD.exe | |
User: admin Company: Evernote Corp., 305 Walnut Street, Redwood City, CA 94063 Integrity Level: MEDIUM Description: Additional Landfills Tbs Nnquery Rad Pageeconomics |
PID | Process | Filename | Type | |
---|---|---|---|---|
3508 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRE754.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3508 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C3608C67-8D08-4C7E-A2D7-E271ABD89B8F}.tmp | — | |
MD5:— | SHA256:— | |||
3508 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{09A964ED-7E63-4D2C-A923-28198CD80C09}.tmp | — | |
MD5:— | SHA256:— | |||
3508 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\~$voice#1912103.doc.rtf | pgc | |
MD5:E67F33EE2A8B57F23156B9530C0F3403 | SHA256:65FCD7B42A4901DFC11FA446B3576A5A247EF346CC8CB3D46112D3440CE00DB4 | |||
3508 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:F55A9FBFF282CA33FACD1F05EBB029CB | SHA256:2B4892E9CA88C8D8182FFA80064605E0B63FE9CA589AB4E668053B64EC38B310 | |||
3508 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:56F575D05EFBC1E63C4B06BCAF85D9D0 | SHA256:C42BCF6A7CD825244C49BE138F201E3FCE18ED84BC2D29A091B48AA13B4147B1 | |||
3508 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Invoice#1912103.doc.rtf.LNK | lnk | |
MD5:B423F10DAFB960F010C276D74877804F | SHA256:36543DD9894A667CCC5DB5720BC56828F8F7AC5C76010B05370A18B1224BF8B2 | |||
3508 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\A.R | executable | |
MD5:5F235FCAA04BDFFE035414EAC5A3E73C | SHA256:D981A780F23E569B5BF70C14F287989AF00ED1B8D1B9B0CCA7C14987D1D163F1 | |||
3508 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1D3A9F8D.emf | emf | |
MD5:F7961E44FE51CEEE06391905162E18E0 | SHA256:DCD5C765BCCFAC9339A8985357B391A3FAC1AE571AC0E5A971938573742F306D | |||
3508 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{7F71F97D-001F-4F73-B7DB-5BB1332F689E}.tmp | binary | |
MD5:EEA23EC1C55429EBC6C79B77F0CEDC19 | SHA256:FCDE31F6027A9B3491455F9137F6243DF56EEE0E4EF226C833DF0A894E03DCE6 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3528 | A.R | POST | — | 213.183.51.36:80 | http://plikerss.hk/tinss/memz3/fre.php | NL | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3528 | A.R | 213.183.51.36:80 | plikerss.hk | Melbikomas UAB | NL | suspicious |
Domain | IP | Reputation |
---|---|---|
plikerss.hk |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
3528 | A.R | A Network Trojan was detected | ET TROJAN LokiBot User-Agent (Charon/Inferno) |
3528 | A.R | A Network Trojan was detected | ET TROJAN LokiBot Checkin |