flash

Informacion_29.doc

Status: finished
Submission Time: 07.01.2021 11:46:09
Malicious
Trojan
Evader
Emotet

Comments

Tags

Details

  • Analysis ID:
    336937
  • API (Web) ID:
    575766
  • Analysis Started:
    07.01.2021 11:46:12
  • Analysis Finished:
    07.01.2021 12:02:02
  • MD5:
    6c1cb4c06ead6f5ce29a931fa12410fa
  • SHA1:
    4ac228fa54e73993dcccb69389a97cfcf67228b5
  • SHA256:
    43dab9a4e7aaa8a0d894f6e64d73bb829dd8c40ff8161233fb6e0886b14819c3
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports
New

System: Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

malicious
96/100

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run Condition: Potential for more IOCs and behavior

malicious
100/100

malicious
34/54

malicious
23/36

malicious
23/29

IPs

IP Country Detection
66.85.46.76
United States
152.170.79.100
Argentina
58.97.195.135
Bangladesh
Click to see the 5 hidden entries
190.247.139.101
Argentina
35.214.169.246
United States
193.187.117.26
Netherlands
70.32.23.58
United States
138.197.99.250
United States

Domains

Name IP Detection
rycomputer.com
58.97.195.135
00zyku.com
193.187.117.26
wheelcomoving.com
66.85.46.76
Click to see the 2 hidden entries
d-cem.com
35.214.169.246
ketoresetme.com
70.32.23.58

URLs

Name Detection
https://ketoresetme.com/2021/01/07/what-to-avoid-on-a-ketogenic-diet-what-is-ketogenic-diet/
https://wheelcomoving.com/services/
http://138.197.99.250:8080/pojcpxbjelqvypvfo/yrdgm/3jyit2m1109dcs3q5kt/4fhdprpbuz1qz/rfz2dy2jzdc4/o5jeelwiaa1pjy12utx/
Click to see the 97 hidden entries
http://00zyku.com
https://wheelcomoving.com/company/contact/
https://ketoresetme.com/wp-content/uploads/2021/01/Beyond-Keto-Virtual-Summit-The-Mid-Life-Re-Life-B
https://ketoresetme.com/wp-content/uploads/2021/01/The-Ketonian-Cookbook-QUICK-AND-EASY-LOW-CARB-218
https://wheelcomoving.com/services/ocean-cargo/
https://ketoresetme.com/wp-content/uploads/2021/01/The-Ketonian-Cookbook-QUICK-AND-EASY-LOW-CARB-100
https://ketoresetme.com/2021/01/06/keto-reset-instant-pot-cookbook-trailer/
https://ketoresetme.com/2021/01/07/what-i-eat-to-lose-weight-2020-easy-keto-recipes-keto-full-day-ea
https://ketoresetme.com/wp-content/uploads/2020/09/11.jpg
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
https://rpsticket.partnerservices.getmicrosoftkey.com
https://lookup.onenote.com/lookup/geolocation/v1
https://freejavporn.mobi/
http://wheelcomoving.com/wp-content/plugins/wpcargo/assets/css/fontawesome.min.css?ver=6.7.4
http://138.197.99.250:8080/pojcpxbjelqvypvfo/yrdgm/3jyit2m1109dcs3q5kt/4fhdprpbuz1qz/rfz2dy2jzdc4/o5
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
https://wheelcomoving.com/wp-admin/admin-ajax.php
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
https://api.aadrm.com/
http://d-cem.com
http://00zyku.comx
https://ketoresetme.com/author/admin/
https://ketoresetme.com/category/keto-summit/
https://wheelcomoving.com/wp-content/uploads/2015/09/Cargo-logo-white1.png
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
https://api.microsoftstream.com/api/
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
https://cr.office.com
https://nuget.org/nuget.exe
https://ketoresetme.com/xmlrpc.p
http://wheelcomoving.com/wp-content/themes/cargo/js/slick.min.js?ver=5.6
http://wheelcomoving.com/wp-content/themes/cargo/style.css?ver=5.6
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://ketoresetme.com/wp-content/themes/Newspaper/style.css?ver=8.1
https://res.getmicrosoftkey.com/api/redemptionevents
https://ketoresetme.com/category/keto-news/
https://tasks.office.com
http://ketoresetme.com/xmlrpc.php
https://officeci.azurewebsites.net/api/
https://ketoresetme.com/wp-content/uploads/2020/09/reclama-lifestyle.jpg
https://store.office.cn/addinstemplate
http://pesterbdd.com/images/Pester.png
http://cps.letsencrypt.org0
https://wus2-000.pagecontentsync.
http://www.apache.org/licenses/LICENSE-2.0.html
https://rajwap.pro/
https://contoso.com/Icon
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
https://ketoresetme.com/contact-us/
https://www.odwebp.svc.ms
https://api.powerbi.com/v1.0/myorg/groups
https://web.microsoftstream.com/video/
https://graph.windows.net
https://github.com/Pester/Pester
http://wheelcomoving.com/wp-includes/css/dist/block-library/style.min.css?ver=5.6
https://arabysexy.mobi/
http://ketoresetme.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
http://ketoresetme.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/vendors-styl
https://dynamic.t
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
https://dirtyindianporn.info/
https://dev.virtualearth.net/REST/v1/Routes/Transit
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
http://weather.service.msn.com/data.aspx
http://wheelcomoving.com/wp-content/themes/cargo/js/header.misc.js?ver=5.6
http://wheelcomoving.com/wp-content/plugins/wpcargo/admin/assets/css/jquery.datetimepicker.min.css?v
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
https://ketoresetme.com/privacy-policy-2/
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
http://192.168.0.194/wp_011_lifestyle/wp-content/uploads/2017/03/2.jpg
https://clients.config.office.net/user/v1.0/ios
http://ketoresetme.com/wp-content/plugins/woocommerce/assets/css/woocommerce-layout.css?ver=4.5.1
https://dev.virtualearth.net/REST/v1/Routes/Driving
https://o365auditrealtimeingestion.manage.office.com
https://wheelcomoving.com/xmlrpc.php?rsd
https://outlook.office365.com/api/v1.0/me/Activities
http://ketoresetme.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=
https://clients.config.office.net/user/v1.0/android/policies
http://wheelcomoving.com/wp-content/plugins/wpcargo/assets/css/wpcargo-style.css?ver=6.7.4
https://entitlement.diagnostics.office.com
http://190.247.139.101/o7vtz/g3p9nxague/
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
https://outlook.office.com/
https://storage.live.com/clientlogs/uploadlocation
http://190.247.139.101/o7vtz/g3p9nxague/llc
https://indianpornmovies.info/
https://ketoresetme.com/category/keto/
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
https://shell.suite.office.com:1443
https://ketoresetme.com/wp-content/uploads/2021/01/My-Southern-Keto-Kitchen-Cookbook-HOW-I-GOT-HERE-
https://autodiscover-s.outlook.com/
http://wheelcomoving.com/wp-content/plugins/bt_cost_calculator/jquery.dd.js?ver=5.6
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
https://ketoresetme.com/2021/01/07/pepito-manaloto-keto-diet-sagot-sa-katabaan-ni-mara/#respond
http://wheelcomoving.com/wp-includes/wlwmanifest.xml
https://cdn.entity.

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Informacion_29.doc.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 14:03:41 2020, mtime=Thu Jan 7 18:52:50 2021, atime=Thu Jan 7 18:52:48 2021, length=166400, window=hide
#
C:\Users\user\Nsghoht\Gbh5r9o\Q27V.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\ProgramData\Microsoft\Network\Downloader\edb.log
data
#
Click to see the 14 hidden entries
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
Extensible storage engine DataBase, version 0x620, checksum 0x9a06615d, page size 16384, DirtyShutdown, Windows version 10.0
#
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
data
#
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6CAFC0F8-7648-4F12-BE38-DAA8582ADD66
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{189012B4-0261-4128-8568-9DA4BA8F2187}.tmp
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_avja2edr.udc.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qa55wgu1.34a.psm1
very short file (no magic)
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
#
C:\Users\user\Desktop\~$formacion_29.doc
data
#
C:\Users\user\Documents\20210107\PowerShell_transcript.494126.5cvYSlfI.20210107115253.txt
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
#
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
ASCII text, with no line terminators
#
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log
data
#