Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
101POH0000000166.rtf

Overview

General Information

Sample Name:101POH0000000166.rtf
Analysis ID:791304
MD5:5241cc04162b7134f0e28d75286e8403
SHA1:3a9e51c888314e69aa258492da237c1d4737f6b6
SHA256:5dcd3d5273d069fe4825f22323aed5b7eaa8c745f5974e757c1919fbbcf6bcae
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:60%

Signatures

Sample execution stops while process was sleeping (likely an evasion)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Analysis Advice

No malicious behavior found, analyze the document also on other version of Office / Acrobat
Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook
  • System is w10x64
  • WINWORD.EXE (PID: 5888 cmdline: "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding MD5: 0B9AB9B9C4DE429473D6450D4297A123)
    • splwow64.exe (PID: 5060 cmdline: C:\Windows\splwow64.exe 12288 MD5: 8D59B31FF375059E3C32B17BF31A76D5)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Snort rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://api.aadrm.com
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://api.aadrm.com/
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: 913A360A-E69B-44A8-AAEF-E0FC3C105644.0.drString found in binary or memory: https://api.addins.s