Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc

Overview

General Information

Sample Name:SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc
Analysis ID:753420
MD5:d38967e524822d04257534078b0dc209
SHA1:b2af456f879fba7dffa694d9386f501883118822
SHA256:5e458e56f23f18feb1e44f3eb3c15ab7d4d6cd9e937c72528dfce9d5e195ea3c
Tags:CVE-2017-11882doc
Infos:

Detection

Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for submitted file
Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

  • System is w10x64
  • WINWORD.EXE (PID: 5020 cmdline: "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding MD5: 0B9AB9B9C4DE429473D6450D4297A123)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Snort rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.docAvira: detected
Source: C:\Users\user\AppData\Local\Temp\~DFB5F29BA7599D9D0F.TMPAvira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.docReversingLabs: Detection: 53%
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.docVirustotal: Detection: 51%Perma Link
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.aadrm.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.aadrm.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.cortana.ai
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.office.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.onedrive.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://api.scheduler.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://augloop.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://augloop.office.com/v2
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://cdn.entity.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://clients.config.office.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://config.edge.skype.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://cortana.ai
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://cortana.ai/api
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://cr.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://dev.cortana.ai
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://devnull.onenote.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://directory.services.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://enrichment.osi.office.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://graph.windows.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://graph.windows.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://invites.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://lifecycle.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://login.windows.local
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://management.azure.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://management.azure.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://messaging.action.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://messaging.engagement.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://messaging.lifecycle.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://messaging.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://ncus.contentsync.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://ncus.pagecontentsync.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://officeapps.live.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://onedrive.live.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://osi.office.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://otelrules.azureedge.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://outlook.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://outlook.office.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://outlook.office365.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://outlook.office365.com/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://pages.store.office.com/review/query
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://powerlift.acompli.net
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://settings.outlook.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://staging.cortana.ai
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://tasks.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://webshell.suite.office.com
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://wus2.contentsync.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://wus2.pagecontentsync.
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 8DD21DB6-A354-43E1-AA05-383562B87248.0.drString found in binary or memory: https://www.odwebp.svc.ms
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.docOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DFB5F29BA7599D9D0F.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.docReversingLabs: Detection: 53%
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.docVirustotal: Detection: 51%
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\{DE9FD35A-BDFC-4C44-BACC-EE3CA85858A6} - OProcSessId.datJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: classification engineClassification label: mal64.winDOC@1/14@0/0
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.docOLE document summary: title field not present or empty
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.docOLE document summary: author field not present or empty
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.docOLE document summary: edited time not present or 0
Source: ~DFB5F29BA7599D9D0F.TMP.0.drOLE document summary: title field not present or empty
Source: ~DFB5F29BA7599D9D0F.TMP.0.drOLE document summary: author field not present or empty
Source: ~DFB5F29BA7599D9D0F.TMP.0.drOLE document summary: edited time not present or 0
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.LNK.0.drLNK file: ..\..\..\..\..\Desktop\SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.doc
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.WordJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
Source: SecuriteInfo.com.Exploit.CVE-2017-11882.123.29721.1282.docInitial sample: OLE indicators vbamacros = False
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program