Loading... Additional Content is being loaded
Windows Analysis Report RFQ-18072 QPHN .doc
Overview
General Information
| Sample Name: | RFQ-18072 QPHN .doc |
| Analysis ID: | 532835 |
| MD5: | dc496cbd7363e5eaded70c3b82d945b4 |
| SHA1: | 1cba05eefbf3dd00f0e09591e676b9d2674319be |
| SHA256: | 7398809e85fd3717f942bae422ed238f230d214359819afe88ae28e619b3b7b1 |
| Tags: | docFormbook |
| Infos: | |
|
Most interesting Screenshot:  |
|
Detection
FormBook
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Document contains OLE streams which likely are hidden ActiveX objects
Sigma detected: Office product drops script at suspicious location
System process connects to network (likely due to code injection or exploit)
Document exploit detected (creates forbidden files)
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Sigma detected: Droppers Exploiting CVE-2017-11882
Maps a DLL or memory area into another process
Sigma detected: Suspicious Script Execution From Temp Folder
Document contains OLE streams with names of living off the land binaries
Creates processes via WMI
Found potential equation exploit (CVE-2017-11882)
Injects a PE file into a foreign processes
Tries to detect virtualization through RDTSC time measurements
Sigma detected: WScript or CScript Dropper
Sample uses process hollowing technique
Writes to foreign memory regions
Sigma detected: Microsoft Office Product Spawning Windows Shell
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Very long command line found
Microsoft Office drops suspicious files
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Found suspicious RTF objects
Antivirus or Machine Learning detection for unpacked file
Document has an unknown application name
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
Document misses a certain OLE stream usually present in this Microsoft Office document type
Contains long sleeps (>= 3 min)
Potential document exploit detected (unknown TCP traffic)
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Internet Provider seen in connection with other malware
Stores large binary data to the registry
Found potential string decryption / allocating functions
Contains functionality to call native functions
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Document contains Microsoft Equation 3.0 OLE entries
Enables debug privileges
Document contains no OLE stream with summary information
Office Equation Editor has been started
Creates a window with clipboard capturing capabilities
Potential document exploit detected (performs HTTP gets)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Classification
AV Detection: |
  |
|---|
| Antivirus detection for dropped file |
| Source: |
Avira: |
||
| Found malware configuration |
| Source: |
Malware Configuration Extractor: |
||
| Multi AV Scanner detection for submitted file |
| Source: |
ReversingLabs: |
||
| Yara detected FormBook |
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Antivirus or Machine Learning detection for unpacked file |
| Source: |
Avira: |
||
| Source: |
Avira: |
||
| Source: |
Avira: |
||
| Source: |
Avira: |
||
Exploits: |
|
|---|
| Found potential equation exploit (CVE-2017-11882) |
| Source: |
Static RTF information: |
||
| Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) |
| Source: |
Process created: |
|||
| Source: |
Process created: |
Jump to behavior | ||
| Document contains Microsoft Equation 3.0 OLE entries |
| Source: |
Stream path '_1699975275/\x1CompObj' : |
||
| Office Equation Editor has been started |
| Source: |
Process created: |
||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
HTTPS traffic detected: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
Software Vulnerabilities: |
|
|---|
| Document exploit detected (creates forbidden files) |
| Source: |
File created: |
Jump to behavior | ||
| Potential document exploit detected (unknown TCP traffic) |
| Source: |
TCP traffic: |
||
| Potential document exploit detected (performs DNS queries) |
| Source: |
DNS query: |
||
| Potential document exploit detected (performs HTTP gets) |
| Source: |
TCP traffic: |
||
Networking: |
|
|---|
| System process connects to network (likely due to code injection or exploit) |
| Source: |
Domain query: |
|||
| Source: |
Domain query: |
|||
| Source: |
Network Connect: |
Jump to behavior | ||
| C2 URLs / IPs found in malware configuration |
| Source: |
URLs: |
||
| JA3 SSL client fingerprint seen in connection with other malware |
| Source: |
JA3 fingerprint: |
||
| HTTP GET or POST without a user agent |
| Source: |
HTTP traffic detected: |
||
| Uses a known web browser user agent for HTTP communication |
| Source: |
HTTP traffic detected: |
||
| Internet Provider seen in connection with other malware |
| Source: |
ASN Name: |
||
| IP address seen in connection with other malware |
| Source: |
IP Address: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
File created: |
Jump to behavior | ||
| Source: |
DNS traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
Network traffic detected: |
||
| Source: |
Network traffic detected: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
HTTPS traffic detected: |
||
Key, Mouse, Clipboard, Microphone and Screen Capturing: |
|
|---|
| Creates a window with clipboard capturing capabilities |
| Source: |
Window created: |
Jump to behavior | ||
E-Banking Fraud: |
|
|---|
| Yara detected FormBook |
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
System Summary: |
|
|---|
| Document contains OLE streams which likely are hidden ActiveX objects |
| Source: |
Stream path '_1699975273/\x1Ole10Native' : |
||
| Malicious sample detected (through community Yara rule) |
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Source: |
Matched rule: |
||
| Document contains OLE streams with names of living off the land binaries |
| Source: |
Stream path '_1699975273/\x1Ole10Native' : | ||