File name:

SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.26519.7365

Full analysis: https://app.any.run/tasks/fbe450b4-ec39-48b4-9b88-870a661cff0d
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: August 01, 2023, 17:34:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
exploit
cve-2017-11882
loader
stealer
agenttesla
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1
MD5:

14F3F5D1FA15A84D0408683136ECF11B

SHA1:

A2B5C457C68E25733BB3C304921BD1C17F5DF7C8

SHA256:

D0F587D98A7B30811509FCA9474B18611712DB554E7F80A72F7FF759FAE1008F

SSDEEP:

48:dkHn/vp5YMUFaRdhXFA6tppFUCeD+/pgyHAQLNwMiw66MSuR/0jcO+P04ORLHAYp:dkHpOrcFXFA6ZjM9H84sAYp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 316)

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 316)

    • Actions looks like stealing of personal data

      • word.exe (PID: 1812)
      • jsc.exe (PID: 1748)

    • Application was dropped or rewritten from another process

      • word.exe (PID: 1812)

    • Steals credentials from Web Browsers

      • jsc.exe (PID: 1748)

    • AGENTTESLA detected by memory dumps

      • jsc.exe (PID: 1748)

  • SUSPICIOUS

    • Reads the Internet Settings

      • EQNEDT32.EXE (PID: 316)
      • jsc.exe (PID: 1748)

    • Process requests binary or script from the Internet

      • EQNEDT32.EXE (PID: 316)

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 316)

    • Reads settings of System Certificates

      • jsc.exe (PID: 1748)

    • Accesses Microsoft Outlook profiles

      • jsc.exe (PID: 1748)

    • Connects to SMTP port

      • jsc.exe (PID: 1748)

  • INFO

    • Reads the computer name

      • EQNEDT32.EXE (PID: 316)
      • word.exe (PID: 1812)
      • jsc.exe (PID: 1748)

    • Reads the machine GUID from the registry

      • EQNEDT32.EXE (PID: 316)
      • word.exe (PID: 1812)
      • jsc.exe (PID: 1748)

    • Checks proxy server information

      • EQNEDT32.EXE (PID: 316)

    • Creates files or folders in the user directory

      • EQNEDT32.EXE (PID: 316)

    • Checks supported languages

      • word.exe (PID: 1812)
      • jsc.exe (PID: 1748)
      • EQNEDT32.EXE (PID: 316)

    • The process checks LSA protection

      • word.exe (PID: 1812)
      • jsc.exe (PID: 1748)
      • EQNEDT32.EXE (PID: 316)

    • Reads Environment values

      • jsc.exe (PID: 1748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AgentTesla

(PID) Process(1748) jsc.exe
Protocolsmtp
Hostmail.sgbumperscar.com
Port587
Usernameptt-mary@sgbumperscar.com
Passwordtien3012m
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
17
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe word.exe edmgen.exe no specs addinutil.exe no specs applaunch.exe no specs aspnet_state.exe no specs servicemodelreg.exe no specs mscorsvw.exe no specs aspnet_regsql.exe no specs aspnet_wp.exe no specs setuputility.exe no specs regasm.exe no specs installutil.exe no specs msbuild.exe no specs #AGENTTESLA jsc.exe regtlibv12.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
360"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe—word.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WCF Generic Command for Vista Setup
Exit code:
4294967295
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\microsoft.net\framework64\v4.0.30319\servicemodelreg.exe
684"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe—word.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInUtil.exe
Exit code:
4294967295
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\addinutil.exe
c:\windows\system32\ntdll.dll
920"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe—word.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ASP.NET State Server
Exit code:
4294967295
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe
c:\windows\system32\ntdll.dll
1004"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe—word.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Runtime Optimization Service
Exit code:
4294967295
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe
c:\windows\system32\ntdll.dll
1036"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe—word.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
EdmGen.exe
Exit code:
4294967295
Version:
4.7.2558.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\edmgen.exe
c:\windows\system32\ntdll.dll
1600"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe—word.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_wp.exe
Exit code:
4294967295
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_wp.exe
c:\windows\system32\ntdll.dll
1704"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.02558\SetupUtility.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.02558\SetupUtility.exe—word.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework 4.5 Setup
Exit code:
3221226540
Version:
14.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\microsoft.net\framework64\v4.0.30319\setupcache\v4.7.02558\setuputility.exe
c:\windows\syswow64\ntdll.dll
1748"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
word.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
jsc.exe
Exit code:
0
Version:
14.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\jsc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
AgentTesla
(PID) Process(1748) jsc.exe
Protocolsmtp
Hostmail.sgbumperscar.com
Port587
Usernameptt-mary@sgbumperscar.com
Passwordtien3012m
1812C:\Users\admin\AppData\Roaming\word.exeC:\Users\admin\AppData\Roaming\word.exe
EQNEDT32.EXE
User:
admin
Company:
自間耳骨米
Integrity Level:
MEDIUM
Description:
耳 至香 米鳥米陽 羽黽自九羽釆而十 考間至面米田考青老 羽非考臼自飛吾間 而香而閒至身 自足羊隻老車至骨自 至艮吾黽羊辛米 老十老麥而面至長.
Exit code:
0
Version:
8.9.9.7
Modules
Images
c:\users\admin\appdata\roaming\word.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
Total events
4 146
Read events
3 678
Write events
336
Delete events
132

Modification events

(PID) Process:(2692) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2692) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(2692) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(2692) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(2692) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(2692) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(2692) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(2692) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(2692) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(2692) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2692WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE89D.tmp.cvr —
MD5:—
SHA256:—
2692WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$curiteInfo.com.Exploit.RTF-ObfsObjDat.Gen.26519.7365.rtfbinary
MD5:03D432D472BDFF1C3FA33B45077BDB80
SHA256:98AB258B6EF0A816102FEB8E661C3A514E961C153A446DFED56E8D30103D6B81
316EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\Xf3sqCGlbaOri[1].exeexecutable
MD5:F7E6328965C8ECE80786C6A6C4770F91
SHA256:65E3A49F9DC56443442D072363A26355F70EB9D91D16B361969FB9E904ED03EC
316EQNEDT32.EXEC:\Users\admin\AppData\Roaming\word.exeexecutable
MD5:F7E6328965C8ECE80786C6A6C4770F91
SHA256:65E3A49F9DC56443442D072363A26355F70EB9D91D16B361969FB9E904ED03EC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
4
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
316
EQNEDT32.EXE
GET
200
121.52.157.123:80
http://feedeposit.uob.edu.pk/Xf3sqCGlbaOri.exe
PK
executable
576 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
316
EQNEDT32.EXE
121.52.157.123:80
feedeposit.uob.edu.pk
PERN AS Content Servie Provider, Islamabad, Pakistan
PK
suspicious
328
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1748
jsc.exe
173.231.16.76:443
api.ipify.org
WEBNX
US
malicious
1748
jsc.exe
119.17.253.214:587
mail.sgbumperscar.com
Netnam Company
VN
malicious

DNS requests

Domain
IP
Reputation
feedeposit.uob.edu.pk
  • 121.52.157.123
suspicious
teredo.ipv6.microsoft.com
  • —
whitelisted
api.ipify.org
  • 173.231.16.76
  • 64.185.227.156
  • 104.237.62.211
shared
mail.sgbumperscar.com
  • 119.17.253.214
malicious

Threats

PID
Process
Class
Message
316
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1748
jsc.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Exfiltration via SMTP (AgentTesla)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.26519.7365