rNUFZ6XE3E.pptx
| Engine | Download Report | Detection | Info |
|---|---|---|---|
|
malicious
|
||
|
malicious
Score: 84
|
System: unknown
|
|
|
|
malicious
Score: 92
|
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run Condition: Potential for more IOCs and behavior
|
| Name | Detection |
|---|---|
| http://www.fonts.com |  |
| http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue | |
| http://purl.oclc.org/ooxml/drawingml/diagramAsP | |
| Click to see the 35 hidden entries | |
| http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue | |
| http://schemas.xmlsoap.org/soap/http | |
| http://www.jiyu-kobo.co.jp/ | |
| http://www.zhongyicts.com.cnk? | |
| http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient | |
| http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue | |
| http://www.tiro.comQ | |
| http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never | |
| http://www.sandoll.co.kr | |
| http://www.zhongyicts.com.cn | |
| http://www.founder.com.cn/cnei | |
| http://www.carterandcone.como. | |
| http://www.sakkal.com | |
| https://fs.msidlab6.com/adfs/services/trust/2005/usernamemixed | |
| http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Never | |
| http://www.tiro.comic8 | |
| http://en.w | |
| http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702 | |
| http://www.founder.com.cn/cn/bThe | |
| http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal | |
| http://www.tiro.comn | |
| http://www.tiro.com | |
| http://www.goodfont.co.kr | |
| http://purl.oclc.org/ooxml/drawingml/tableO | |
| http://www.tiro.comace | |
| http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient | |
| http://www.apache.org/licenses/LICENSE-2.0 | |
| http://www.carterandcone.coml | |
| http://www.sajatypeworks.com | |
| http://www.founder.com.cn/cn/ | |
| http://www.typography.netD | |
| http://www.founder.com.cn/cn/cThe | |
| http://fontfabrik.com | |
| http://schemas.xmlsoap.org/ws/2005/07/securitypolicy | |
| http://www.founder.com.cn/cn | |
| Name | File Type | Hashes | Detection |
|---|---|---|---|
C:\Users\user\Desktop\~$rNUFZ6XE3E.pptx |
data | # |  |
C:\Users\user\AppData\Local\Temp\exe.exe:Zone.Identifier |
ASCII text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\exe.exe |
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows | # | |
| Click to see the 18 hidden entries | |||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\msoEE36.tmp |
ms-windows metafont .wmf | # | |
\Device\ConDrv |
ASCII text, with CRLF line terminators | # | |
C:\Users\user\Desktop\ppt840F.tmp:Zone.Identifier |
ASCII text, with CRLF line terminators | # | |
C:\Users\user\Desktop\ppt840F.tmp |
data | # | |
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\rNUFZ6XE3E.LNK |
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu May 23 20:36:40 2019, mtime=Tue Dec 3 17:24:19 2019, atime=Tue Dec 3 17:24:10 2019, length=41991, window=hide | # | |
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat |
ASCII text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\~DF7F262463EA4FA78D.TMP |
data | # | |
C:\Users\user\AppData\Local\Temp\aria-debug-248.log |
ASCII text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\exe.exe.log |
ASCII text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\mso744F.tmp |
Targa image data - Map - RLE 1569 x 65536 x 0 +2 "\005" | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B180A260.bin |
Composite Document File V2 Document, Cannot read section info | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9AE94B02.wmf |
Targa image data - Map - RLE 1569 x 65536 x 0 +2 "\005" | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\24ED9B1B.wmz |
Targa image data - Map - RLE 1569 x 65536 x 0 +2 "\005" | # | |
C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db.session-journal |
data | # | |
C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db.session |
SQLite 3.x database, last written using SQLite version 3019003 | # | |
C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-wal |
SQLite Write-Ahead Log, version 3007000 | # | |
C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-journal |
data | # | |
C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db |
SQLite 3.x database, last written using SQLite version 3019003 | # | |
