Play interactive tour
Edit tourWindows Analysis Report RFQ-18072 QPHN .doc
Overview
General Information
| Sample Name: | RFQ-18072 QPHN .doc |
| Analysis ID: | 532835 |
| MD5: | dc496cbd7363e5eaded70c3b82d945b4 |
| SHA1: | 1cba05eefbf3dd00f0e09591e676b9d2674319be |
| SHA256: | 7398809e85fd3717f942bae422ed238f230d214359819afe88ae28e619b3b7b1 |
| Tags: | docFormbook |
| Infos: | |
Most interesting Screenshot:  | |
Detection
FormBook
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Document contains OLE streams which likely are hidden ActiveX objects
Sigma detected: Office product drops script at suspicious location
System process connects to network (likely due to code injection or exploit)
Document exploit detected (creates forbidden files)
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Sigma detected: Droppers Exploiting CVE-2017-11882
Maps a DLL or memory area into another process
Sigma detected: Suspicious Script Execution From Temp Folder
Document contains OLE streams with names of living off the land binaries
Creates processes via WMI
Found potential equation exploit (CVE-2017-11882)
Injects a PE file into a foreign processes
Tries to detect virtualization through RDTSC time measurements
Sigma detected: WScript or CScript Dropper
Sample uses process hollowing technique
Writes to foreign memory regions
Sigma detected: Microsoft Office Product Spawning Windows Shell
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Very long command line found
Microsoft Office drops suspicious files
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Found suspicious RTF objects
Antivirus or Machine Learning detection for unpacked file
Document has an unknown application name
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
Document misses a certain OLE stream usually present in this Microsoft Office document type
Contains long sleeps (>= 3 min)
Potential document exploit detected (unknown TCP traffic)
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Internet Provider seen in connection with other malware
Stores large binary data to the registry
Found potential string decryption / allocating functions
Contains functionality to call native functions
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Document contains Microsoft Equation 3.0 OLE entries
Enables debug privileges
Document contains no OLE stream with summary information
Office Equation Editor has been started
Creates a window with clipboard capturing capabilities
Potential document exploit detected (performs HTTP gets)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Classification
Process Tree |
|---|
|
