File name: | d4acdffe14d9a59e94f4488dcdad3abc2dce847a3f756a25b06fc23d42e8056b.rtf |
Full analysis: | https://app.any.run/tasks/c2f2d5af-e4ab-475c-9764-4473e9491377 |
Verdict: | Malicious activity |
Analysis date: | March 31, 2020, 04:33:34 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, unknown version |
MD5: | 81FF174060CE706D9E3F3A3D9117A01F |
SHA1: | 46D07FF6A8EF26CF294EAF45D72F1EAC28D78EE2 |
SHA256: | D4ACDFFE14D9A59E94F4488DCDAD3ABC2DCE847A3F756A25B06FC23D42E8056B |
SSDEEP: | 1536:Ox1JtZM4bC06mf5gAKLCKvgnKnalAMp+j8d/fp4L0XzCMa64jnH4VjO6yUscTM4H:Ox1JbMw88T4L11jHsTv/v |
.rtf | | | Rich Text Format (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3364 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\d4acdffe14d9a59e94f4488dcdad3abc2dce847a3f756a25b06fc23d42e8056b.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3352 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3364 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR7CE9.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3352 | EQNEDT32.EXE | C:\ProgramData\encx.com | — | |
MD5:— | SHA256:— | |||
3364 | WINWORD.EXE | C:\Users\admin\Desktop\~$acdffe14d9a59e94f4488dcdad3abc2dce847a3f756a25b06fc23d42e8056b.rtf | pgc | |
MD5:353E42ADB625641351A8019A37B3CCB1 | SHA256:37EB723AC584D58435CF56B9147D5083434B8EA4455F92D2D0B07FFC1D9294CF | |||
3364 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:590D78103669C3F8759447C7133CDAE6 | SHA256:4CB23FAB6EBDE683F9623E0BAD5BEE137093A02D33867372542B117700C30084 | |||
3364 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | ini | |
MD5:CA98D5997AE8830384D375D2E335110E | SHA256:FDC47D137D58D4FDC30D5188AACD3FBC4008B29D6AB52DE9E2B862B1FD80FCD0 | |||
3364 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\d4acdffe14d9a59e94f4488dcdad3abc2dce847a3f756a25b06fc23d42e8056b.rtf.LNK | lnk | |
MD5:2B3EC52B0095BA9E3987D2C226E5C931 | SHA256:A883DC456B760481CBC5794A60B71BA012735B22561787EE2D8E0B6BD841C3E3 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3352 | EQNEDT32.EXE | 47.106.73.29:80 | sterilizationvalidation.com | Hangzhou Alibaba Advertising Co.,Ltd. | CN | malicious |
Domain | IP | Reputation |
---|---|---|
sterilizationvalidation.com |
| malicious |