Windows Analysis Report
SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc

Overview

General Information

Sample Name:	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc
Analysis ID:	753420
MD5:	d38967e524822d04257534078b0dc209
SHA1:	b2af456f879fba7dffa694d9386f501883118822
SHA256:	5e458e56f23f18feb1e44f3eb3c15ab7d4d6cd9e937c72528dfce9d5e195ea3c
Tags:	CVE-2017-11882doc
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\~DFB5F29BA7599D9D0F.TMP

Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	ReversingLabs: Detection: 53%
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	Virustotal: Detection: 51%			Perma Link

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.office.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.scheduler.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://augloop.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cdn.entity.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cortana.ai
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cr.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://directory.services.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://graph.windows.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://invites.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://login.windows.local
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://management.azure.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://management.azure.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://osi.office.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://tasks.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DFB5F29BA7599D9D0F.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	ReversingLabs: Detection: 53%
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	Virustotal: Detection: 51%

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{DE9FD35A-BDFC-4C44-BACC-EE3CA85858A6} - OProcSessId.dat

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: classification engine

Classification label: mal64.winDOC@1/14@0/0

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	OLE document summary: title field not present or empty
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	OLE document summary: author field not present or empty
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	OLE document summary: edited time not present or 0
Source: ~DFB5F29BA7599D9D0F.TMP.0.dr	OLE document summary: title field not present or empty
Source: ~DFB5F29BA7599D9D0F.TMP.0.dr	OLE document summary: author field not present or empty
Source: ~DFB5F29BA7599D9D0F.TMP.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\8DD21DB6-A354-43E1-AA05-383562B87248	XML 1.0 document, ASCII text, with CRLF line terminators	9F524557C0D1416C15A2FFF45FEFC3B6	9AE5B80A5E3005C5BA39A5E9130CCB0A3226CD82	CE92A8AC07BA95AFC263617A31A8EA3102AAA3F4E86C6681381E439CD910DB7F
C:\Users\user\AppData\Local\Temp\~DF20830712EE399E97.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\AppData\Local\Temp\~DF22C9AF5F396B32E4.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\AppData\Local\Temp\~DF3B50A295B66BD08B.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\AppData\Local\Temp\~DF3F079023E26CE1AB.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\AppData\Local\Temp\~DF7BF10879A29453F3.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\AppData\Local\Temp\~DFB5F29BA7599D9D0F.TMP	Composite Document File V2 Document, Cannot read section info	D38967E524822D04257534078B0DC209	B2AF456F879FBA7DFFA694D9386F501883118822	5E458E56F23F18FEB1E44F3EB3C15AB7D4D6CD9E937C72528DFCE9D5E195EA3C
C:\Users\user\AppData\Local\Temp\~DFF0188A9052E2C15B.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Aug 16 12:41:30 2022, mtime=Thu Nov 24 18:01:01 2022, atime=Thu Nov 24 18:00:49 2022, length=910336, window=hide	80A9846FF8B7860B8360C6522C306F92	3DB08BF3813AC7F247C5A54C62822C71ACA7412B	730343D2D4F9C88289A46D237203E77B82FBB9067AA018095E43459AE739892E
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	Generic INItialization configuration [doc]	1EB5BE23C9F80FF12073FD8CC0905820	276033018F0E63FA3D0E544387276A6AA75905C7	F8930A570B7580840EE7A3C469CEEBFC7DB7AAE538DF98FF22B7EE6D65A6AD8B
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	data	EA97B7E1EDDA70476AD6C0001C4620AD	E5F90B01FE660C591C4384F345139295FC4300FB	B80A405D74E591376F8C11E0F6E819A410E55090176BEE9723978E1F6F47CAED
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC	Unicode text, UTF-16, little-endian text, with CRLF line terminators	C4F79900719F08A6F11287E3C7991493	754325A769BE6ECCC664002CD8F6BDB0D0B8CA4D	625CA96CCA65A363CC76429804FF47520B103D2044BA559B11EB02AB7B4D79A8
C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex	Unicode text, UTF-16, little-endian text, with no line terminators	F3B25701FE362EC84616A93A45CE9998	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
C:\Users\user\Desktop\~$curiteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	data	EA97B7E1EDDA70476AD6C0001C4620AD	E5F90B01FE660C591C4384F345139295FC4300FB	B80A405D74E591376F8C11E0F6E819A410E55090176BEE9723978E1F6F47CAED

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\~DFB5F29BA7599D9D0F.TMP

Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	ReversingLabs: Detection: 53%
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	Virustotal: Detection: 51%			Perma Link

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.office.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://api.scheduler.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://augloop.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cdn.entity.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cortana.ai
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://cr.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://directory.services.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://graph.windows.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://invites.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://login.windows.local
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://management.azure.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://management.azure.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://osi.office.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://tasks.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DFB5F29BA7599D9D0F.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	ReversingLabs: Detection: 53%
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	Virustotal: Detection: 51%

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{DE9FD35A-BDFC-4C44-BACC-EE3CA85858A6} - OProcSessId.dat

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: classification engine

Classification label: mal64.winDOC@1/14@0/0

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	OLE document summary: title field not present or empty
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	OLE document summary: author field not present or empty
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc	OLE document summary: edited time not present or 0
Source: ~DFB5F29BA7599D9D0F.TMP.0.dr	OLE document summary: title field not present or empty
Source: ~DFB5F29BA7599D9D0F.TMP.0.dr	OLE document summary: author field not present or empty
Source: ~DFB5F29BA7599D9D0F.TMP.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

ID:	753420
Product:	CloudBasic
Start time:	19:59:58
Start date:	24.11.2022
Sample:	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	d38967e524822d04257534078b0dc209
SHA1:	b2af456f879fba7dffa694d9386f501883118822
SHA256:	5e458e56f23f18feb1e44f3eb3c15ab7d4d6cd9e937c72528dfce9d5e195ea3c
Filetype:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%

Windows Analysis Report
SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc