Windows Analysis Report
Chapter 4 Test 4A--2013-2014.doc

Overview

General Information

Sample name:	Chapter 4 Test 4A--2013-2014.doc (renamed file extension from doc (HS-439-27423) to doc)
Original sample name:	Chapter 4 Test 4A--2013-2014.doc (HS-439-27423)
Analysis ID:	1428864
MD5:	56e35d09e7579ef1741ec069a6181ff1
SHA1:	079e55a9cf75724ae89dce3e324467acac21ab72
SHA256:	bbe1a7e68ed8344e33aed458b3cd5e7e739311ae864b7154964e6d4527e444aa
Infos:

Errors Corrupt sample or wrongly selected analyzer.

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Document contains Microsoft Equation 3.0 OLE entries

Document contains an ObjectPool stream indicating possible embedded files or OLE objects

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Chapter 4 Test 4A--2013-2014.doc

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Word\Chapter 4 Test 4A--2013-2014.doc

Avira: detection malicious, Label: EXP/CVE-2018-0798.Gen

Document contains Microsoft Equation 3.0 OLE entries

Source: Chapter 4 Test 4A--2013-2014.doc	Stream path 'ObjectPool/_1160885555/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc	Stream path 'ObjectPool/_1160885643/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc	Stream path 'ObjectPool/_1160890263/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc	Stream path 'ObjectPool/_1160890468/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc	Stream path 'ObjectPool/_1160890548/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc	Stream path 'ObjectPool/_1160890606/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc	Stream path 'ObjectPool/_1160890641/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc	Stream path 'ObjectPool/_1286867940/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc	Stream path 'ObjectPool/_1286868111/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	Stream path 'ObjectPool/_1160885555/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	Stream path 'ObjectPool/_1160885643/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	Stream path 'ObjectPool/_1160890263/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	Stream path 'ObjectPool/_1160890468/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	Stream path 'ObjectPool/_1160890548/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	Stream path 'ObjectPool/_1160890606/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	Stream path 'ObjectPool/_1160890641/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	Stream path 'ObjectPool/_1286867940/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	Stream path 'ObjectPool/_1286868111/\x1CompObj' : ...................F....Microsoft Equation 3.0....

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{AD083452-12AD-436F-8C6B-DC3A21245609}.tmp

Jump to behavior

Document contains an ObjectPool stream indicating possible embedded files or OLE objects

Source: Chapter 4 Test 4A--2013-2014.doc	OLE indicator, ObjectPool: true
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	OLE indicator, ObjectPool: true

Source: classification engine

Classification label: mal56.winDOC@1/5@0/0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6A65.tmp

Jump to behavior

Source: Chapter 4 Test 4A--2013-2014.doc	OLE indicator, Word Document stream: true
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	OLE indicator, Word Document stream: true

Source: Chapter 4 Test 4A--2013-2014.doc	OLE document summary: title field not present or empty
Source: Chapter 4 Test 4A--2013-2014.doc	OLE document summary: author field not present or empty
Source: Chapter 4 Test 4A--2013-2014.doc	OLE document summary: edited time not present or 0
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	OLE document summary: title field not present or empty
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	OLE document summary: author field not present or empty
Source: Chapter 4 Test 4A--2013-2014.doc.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: Chapter 4 Test 4A--2013-2014.doc

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1428864
Product:	CloudBasic
Start time:	18:37:37
Start date:	19.04.2024
Sample:	Chapter 4 Test 4A--2013-2014.doc (HS-439-27423)
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	56e35d09e7579ef1741ec069a6181ff1
SHA1:	079e55a9cf75724ae89dce3e324467acac21ab72
SHA256:	bbe1a7e68ed8344e33aed458b3cd5e7e739311ae864b7154964e6d4527e444aa
Filetype:	Microsoft Word document (32009/1) 79.99%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{AD083452-12AD-436F-8C6B-DC3A21245609}.tmp	data	5D4D94EE7E06BBB0AF9584119797B23A	DBB111419C704F116EFA8E72471DD83E86E49677	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
C:\Users\user\AppData\Local\Temp\Word\Chapter 4 Test 4A--2013-2014.doc	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Number of Words: LCHS, Keywords: 9, Comments: 2, Thumbnail: 1341, 0x17: 786432CDFV2 Microsoft Word	56E35D09E7579EF1741EC069A6181FF1	079E55A9CF75724AE89DCE3E324467ACAC21AB72	BBE1A7E68ED8344E33AED458B3CD5E7E739311AE864B7154964E6D4527E444AA
C:\Users\user\AppData\Local\Temp\Word\Chapter 4 Test 4A--2013-2014.doc:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\AppData\Local\Temp\~DF753031E3E5567B43.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	data	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED	95E13378EA9CACA068B2687F01E9EF13F56627C2	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1

Windows Analysis Report
Chapter 4 Test 4A--2013-2014.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Exploits

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report Chapter 4 Test 4A--2013-2014.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Exploits

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
Chapter 4 Test 4A--2013-2014.doc