File name: | dd34e6415d434c7594e36ea6261a15c37f380ec897c9b553c37f73ea67ba8297.doc |
Full analysis: | https://app.any.run/tasks/ffc36616-2c01-4abe-8848-70911b26ae6b |
Verdict: | Malicious activity |
Analysis date: | October 14, 2019, 07:33:38 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: adm, Template: Normal, Last Saved By: YJO, Revision Number: 3, Name of Creating Application: Microsoft Office Word, Total Editing Time: 02:00, Create Time/Date: Tue Sep 5 10:02:00 2017, Last Saved Time/Date: Fri Oct 11 10:52:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0 |
MD5: | 7F19C61F1936CA2EAA0966B44C019518 |
SHA1: | C4384C1A251667889FDDD01BD1C0D6DF4C7D2E2C |
SHA256: | DD34E6415D434C7594E36EA6261A15C37F380EC897C9B553C37F73EA67BA8297 |
SSDEEP: | 24576:pXpcuPW7kgAuMTxw5dxsIk0aqpZ0ZhyPd:9pF5u5dS0DpZ0ZsP |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | - |
---|---|
Subject: | - |
Author: | adm |
Keywords: | - |
Comments: | - |
Template: | Normal |
LastModifiedBy: | YJO |
RevisionNumber: | 3 |
Software: | Microsoft Office Word |
TotalEditTime: | 2.0 minutes |
CreateDate: | 2017:09:05 09:02:00 |
ModifyDate: | 2019:10:11 09:52:00 |
Pages: | 1 |
Words: | - |
Characters: | 1 |
Security: | None |
CodePage: | Windows Cyrillic |
Company: | - |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 1 |
AppVersion: | 15 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
CompObjUserTypeLen: | 32 |
CompObjUserType: | ???????? Microsoft Word 97-2003 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2428 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\dd34e6415d434c7594e36ea6261a15c37f380ec897c9b553c37f73ea67ba8297.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2696 | C:\Windows\System32\WScript.exe "C:\Users\admin\AppData\Local\Temp\error_log.vbe" | C:\Windows\System32\WScript.exe | taskeng.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3480 | "C:\Windows\system32\ntvdm.exe" -i1 | C:\Windows\system32\ntvdm.exe | — | taskeng.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2428 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA89E.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3480 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs89D2.tmp | — | |
MD5:— | SHA256:— | |||
3480 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs8A50.tmp | — | |
MD5:— | SHA256:— | |||
2428 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:71834CB5A40FD067717E5E242FCFDDE2 | SHA256:053F9EECE736E49AA9E3C99DB635C70D83D2B9311D2D3CA8D612695DCF73376C | |||
2428 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\error_log.vbe | vbe | |
MD5:20713396556441F6F04C8D7ABD28B165 | SHA256:F198812396D9A282EEFC40544FCD3F8F84C5AA09AB02E100DB4D276188AE51FC | |||
2428 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$34e6415d434c7594e36ea6261a15c37f380ec897c9b553c37f73ea67ba8297.doc | pgc | |
MD5:50749DF9A02D14AED914D1727FD937C0 | SHA256:0223B76B8ACA37975726BB7A5AC7B02E80355E9558012ADAF9A6AA71582CB4D2 | |||
2696 | WScript.exe | C:\Users\admin\AppData\Local\Temp\Colors.exe | html | |
MD5:01DB0AB2F8C6B3F39737AAA113E10FFB | SHA256:DD60E9102A177513CDF616AB128691F7CCA10A4A78D1F48284FC4E7E0733D28F |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2696 | WScript.exe | 192.185.195.77:443 | cafeestereo.com | CyrusOne LLC | US | suspicious |
Domain | IP | Reputation |
---|---|---|
cafeestereo.com |
| suspicious |