SecuriteInfo.com.Exploit.Rtf.Obfuscated.64.25308.rtf
| Engine | Download Report | Detection | Info |
|---|---|---|---|
|
malicious
Score: 100
|
System: Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
|
| IP | Country | Detection |
|---|---|---|
| 69.49.231.213 | United States |  |
| Name | IP | Detection |
|---|---|---|
| gingthysyllenesliopa.com | 69.49.231.213 | |
| Name | Detection |
|---|---|
| https://gingthysyllenesliopa.com/a1/mitra.exe | |
| http://pet-vr.net/.tmb/cache/bin_oWBLdyptAp56.bin | |
| http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0 |  |
| Click to see the 19 hidden entries | |
| https://github.com/dotnet/runtime | |
| http://crl.entrust.net/2048ca.crl0 | |
| https://secure.comodo.com/CPS0 | |
| http://www.symauth.com/cps0( | |
| https://gingthysyllenesliopa.com/ | |
| http://ocsp.entrust.net0D | |
| http://nsis.sf.net/NSIS_ErrorError | |
| https://gingthysyllenesliopa.com/a1/mitra.exej | |
| https://github.com/dotnet/runtimeBSJB | |
| http://www.diginotar.nl/cps/pkioverheid0 | |
| https://gingthysyllenesliopa.com/a1/mitra.exeW | |
| https://gingthysyllenesliopa.com/a1/mitra.exeicX | |
| http://www.vmware.com/0/ | |
| http://www.symauth.com/rpa00 | |
| http://ocsp.entrust.net03 | |
| http://crl.entrust.net/server1.crl0 | |
| https://gingthysyllenesliopa.com/a1/mitra.exejjC: | |
| http://www.vmware.com/0 | |
| http://crl.pkioverheid.nl/DomOvLatestCRL.crl0 | |
| Name | File Type | Hashes | Detection |
|---|---|---|---|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{4264E978-4468-4FBA-B78A-8460C16E076C}.tmp |
Composite Document File V2 Document, Cannot read section info | # | |
C:\Users\Public\Pc07.exe |
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\mitra[1].exe |
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive | # | |
| Click to see the 18 hidden entries | |||
C:\Users\user\AppData\Local\Temp\nsj949D.tmp\System.dll |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | # | |
C:\Users\user\Desktop\~$curiteInfo.com.Exploit.Rtf.Obfuscated.64.25308.rtf |
data | # | |
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm |
data | # | |
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat |
ASCII text, with CRLF line terminators | # | |
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\SecuriteInfo.com.Exploit.Rtf.Obfuscated.64.25308.LNK |
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu May 26 08:35:01 2022, mtime=Thu May 26 08:35:01 2022, atime=Thu May 26 08:35:12 2022, length=1880657, window=hide | # | |
C:\Users\user\AppData\Local\Temp\vtshim.c |
C source, ASCII text | # | |
C:\Users\user\AppData\Local\Temp\vm3dc003.dll |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\uninstalla.exe |
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive | # | |
C:\Users\user\AppData\Local\Temp\scanner.png |
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5132D078-0A03-463E-B367-94FBD8B5A13D}.tmp |
data | # | |
C:\Users\user\AppData\Local\Temp\mail-unread-symbolic.symbolic.png |
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced | # | |
C:\Users\user\AppData\Local\Temp\fahrenheit.Roa |
data | # | |
C:\Users\user\AppData\Local\Temp\drive-harddisk-system-symbolic.symbolic.png |
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced | # | |
C:\Users\user\AppData\Local\Temp\System.Runtime.CompilerServices.VisualC.dll |
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\Green_Leaves_21.bmp |
JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, frames 3 | # | |
C:\Users\user\AppData\Local\Temp\Exolve.ini |
ASCII text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C0C1D6A3-6F2A-443A-9B77-F4A1B9FF854F}.tmp |
data | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{76DE1609-7B2E-4BC2-9325-71BD4F5443DB}.tmp |
data | # | |
