flash

a.doc

Status: finished
Submission Time: 08.11.2019 14:08:03
Malicious
Exploiter
Evader
Get2Downloader

Comments

Tags

Details

  • Analysis ID:
    188550
  • API (Web) ID:
    275413
  • Analysis Started:
    08.11.2019 14:08:09
  • Analysis Finished:
    08.11.2019 14:24:19
  • MD5:
    4c4ca17720600c5399ea444794ed5b8b
  • SHA1:
    8618d494e6925bf1c248e7e35c492ac9d8fdfd13
  • SHA256:
    acbaa48df7021a40b00133294af3cd41bce7f6bfa9bb0cb80d8ea10ca0f0d8a3
  • Technologies:
Full Report Engine Info Verdict Score Reports

malicious

System: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Java 8.0.1440.1, Flash 30.0.0.113)

malicious
100/100

malicious
15/60

IPs

IP Country Detection
195.123.246.12
Bulgaria

Domains

Name IP Detection
microsoft-hub-us.com
195.123.246.12

URLs

Name Detection
http://dublincore.org/schemas/xmls/qdc/2003/04/02/dc.xsdes
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
https://microsoft-hub-us.com/vist%dContent-Length:
Click to see the 16 hidden entries
http://schemas.openformatrg/package/2006/r
https://microsoft-hub-us.com/vist
http://crl.entrust.net/server1.crl0
http://cps.letsencrypt.org0
http://ocsp.entrust.net03
http://cert.int-x3.letsencrypt.org/0
http://schemas.openformatrg/package/2006/content-t
http://ocsp.int-x3.letsencrypt.org0/
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
http://www.diginotar.nl/cps/pkioverheid0
http://ocsp.entrust.net0D
https://secure.comodo.com/CPS0
http://schemas.open
http://crl.entrust.net/2048ca.crl0
http://dublincore.org/schemas/xmls/qdc/2003/04/02/dcterms.xsdom
http://cps.root-x1.letsencrypt.org0

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\scheduler_a.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
#
C:\Users\user\Desktop\~$a.doc
data
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
#
Click to see the 13 hidden entries
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AEFAA474.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{275A6E0F-5609-4D57-84E2-463105F0A7E3}.tmp
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{DE42AC8E-14E5-416A-BAD6-76B8126F0853}.tmp
data
#
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
data
#
C:\Users\user\AppData\Local\Temp\oleObject1.bin
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Local\Temp\~$demem.docx.zip
data
#
C:\Users\user\AppData\Local\Temp\~$idemem.docx
data
#
C:\Users\user\AppData\Local\Temp\~WRD0000.tmp
data
#
C:\Users\user\AppData\Local\Temp\~WRD0001.tmp
data
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\a.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sun Sep 24 13:01:37 2017, mtime=Sun Sep 24 13:01:37 2017, atime=Fri Nov 8 12:08:56 2019, length=776192, window=hide
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
#