File name: | 5274217853943808.zip |
Full analysis: | https://app.any.run/tasks/d9ccf55e-dcdf-42d7-9988-af76f62b2565 |
Verdict: | Malicious activity |
Analysis date: | June 19, 2019, 14:55:12 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 8F66B3EAB271327CDB7D6C2A3FF868E2 |
SHA1: | FDB8F732294F558A55D06ED3D973EFA6E4E52681 |
SHA256: | E58171226BEEE1BD13D786CD8715AA2F61CB6DA2AA2FB3AD5A652B81886183AC |
SSDEEP: | 48:9HjliFuVyy75AcEDjRso5jNdsJMntLwLROsabdbwqS4k:FjliFuVyy75AhjRshMtLwdkuP4k |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0009 |
ZipCompression: | Unknown (99) |
ZipModifyDate: | 1980:00:00 00:00:00 |
ZipCRC: | 0x00000000 |
ZipCompressedSize: | 2002 |
ZipUncompressedSize: | 4023 |
ZipFileName: | fafdeecab8c8d69420b761328199a43c16e0a9d49e04c44dddc5ea1907fc7acc |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3524 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\5274217853943808.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
332 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Specifications.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
2660 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
3576 | "C:\Users\admin\AppData\Roaming\dffewasdfdsd.exe" | C:\Users\admin\AppData\Roaming\dffewasdfdsd.exe | — | EQNEDT32.EXE |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2132 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | dffewasdfdsd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 2.0.50727.5420 (Win7SP1.050727-5400) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3524 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb3524.15577\fafdeecab8c8d69420b761328199a43c16e0a9d49e04c44dddc5ea1907fc7acc | — | |
MD5:— | SHA256:— | |||
332 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR5E93.tmp.cvr | — | |
MD5:— | SHA256:— | |||
332 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C76FB9A9-2DB6-49E2-95DB-DDC37E9C5A0C}.tmp | — | |
MD5:— | SHA256:— | |||
332 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{CCE1A527-E4C4-4235-8F55-C1CE9AF7EC36}.tmp | — | |
MD5:— | SHA256:— | |||
2660 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\dffewasdfdsd.exe | executable | |
MD5:A17EBD25BCFA21FD47FF8EA74E9F2E9D | SHA256:B9B676E11B7F6AF3DEE2DB748C149ADFC356C36D1D980117DFA971F73ACE0890 | |||
2660 | EQNEDT32.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\bbo[1].exe | executable | |
MD5:A17EBD25BCFA21FD47FF8EA74E9F2E9D | SHA256:B9B676E11B7F6AF3DEE2DB748C149ADFC356C36D1D980117DFA971F73ACE0890 | |||
332 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Specifications.doc.LNK | lnk | |
MD5:93DA3F0E46AA585842B68CD273AAF02C | SHA256:C4B0D2A0EEF4C71EF269F898AD62FBA76CB1B03FF745B3F05E2761E4CBA30461 | |||
332 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:0D2FB09907D77B0EA8ABBFA0A0033F57 | SHA256:D2B9B135AB18BAD098C7DC28C3AA35267AD49F858C112F6337E8D667BD473C84 | |||
332 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:4E7335E29EA30766BF809BC73BC13AA5 | SHA256:393F7B4D35122249CEDDB31E7BDB5A9F34D5DD2ED45AE1D37115FEE59110F2EE | |||
2660 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat | dat | |
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862 | SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2132 | RegAsm.exe | 198.54.122.60:587 | mail.privateemail.com | Namecheap, Inc. | US | suspicious |
2660 | EQNEDT32.EXE | 112.213.89.40:443 | tfvn.com.vn | SUPERDATA | VN | malicious |
Domain | IP | Reputation |
---|---|---|
tfvn.com.vn |
| unknown |
mail.privateemail.com |
| shared |