flash

sample.doc.doc

Status: finished
Submission Time: 25.11.2021 18:27:17
Malicious
Trojan
Exploiter
Evader

Comments

Tags

  • docx
  • vir

Details

  • Analysis ID:
    528758
  • API (Web) ID:
    896274
  • Analysis Started:
    25.11.2021 18:38:30
  • Analysis Finished:
    25.11.2021 18:46:13
  • MD5:
    6be56f977b6692fb6ce5f94e110664e3
  • SHA1:
    f4d5ce35c656e0f156a2ced453a964faabef09fb
  • SHA256:
    ae94cd20505f914bba5e612acb80c429c5606a739c0838e3a5f87bfcc7cc8519
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

System: Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

malicious
100/100

malicious
30/60

malicious
27/45

malicious

IPs

IP Country Detection
136.243.74.161
Germany
143.95.80.83
United States
192.185.17.114
United States
Click to see the 1 hidden entries
210.211.111.87
Viet Nam

Domains

Name IP Detection
ghapan.com
136.243.74.161
yoowi.net
210.211.111.87
chaturanga.groopy.com
143.95.80.83
Click to see the 2 hidden entries
gruasingenieria.pe
192.185.17.114
lotolands.com
0.0.0.0

URLs

Name Detection
https://ghapan.com/Kdg73onC3o
https://yoowi.net
https://yoowi.net/tDzEJ8uVGwdj/1
Click to see the 51 hidden entries
https://gruasingenieria.pe/LUS1N
https://ghapan.com/Kdg73onC3oQ/0
https://lotolands.com/JtaTAt4
https://ghapan.c
https://gruasingenieria.pe/LUS1NTVui6/090921.html
https://ghapan.com/Kdg73onC3oQ
https://chaturanga.groopy.com
https://ghapan.com/Kdg73onC3oQ/090921.html
https://chaturanga.groopy.com/7SEZBnhMLW/130921.html
https://ghapan.comp
https://yoowi.ne
https://yoowi.net/tDzEJ8uVGwd
https://lotolands.com
https://gruasingenieria.pe
https://lotolands.com/JtaTAt4E
https://lotolands.com/JtaTAt4Ej/130921.html
https://ghapan.com
https://ghapan.com/Kdg73onC3oQ/090921.htmlPE
https://yoowi.net/tDzEJ8uVGwdj/130921.html
https://chaturanga.groopy.com/7S
https://lotolands.com/JtaTAt4Ej/
https://yoowi.net/tDzEJ8uVGwdj
https://gruasingenieria.pe/LU
https://ghapan.com/cgi-sys/suspendedpage.cgi
https://gruasingenieria.pe/LUS
https://chaturanga.groopy.com/
http://www.msnbc.com/news/ticker.txt
http://ocsp.entrust.net03
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
http://www.diginotar.nl/cps/pkioverheid0
https://chaturanga.groopy.com/cgi-sys/suspendedpage.cgi
http://www.icra.org/vocabulary/.
https://gruasingenieria.pe/LUS1NTVui6/090921.htmlPE
http://investor.msn.com/
http://www.%s.comPA
http://ocsp.entrust.net0D
https://chaturanga.groopy.comp
http://servername/isapibackend.dll
http://www.windows.com/pctv.
http://investor.msn.com
http://crl.entrust.net/server1.crl0
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
http://www.hotmail.com/oe
https://lotolands.com/JtaTAt4Ej/130921.htmlPE
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
https://chaturanga.groopy.com/7SEZBnhMLW/130921.htmlPE
https://yoowi.net/tDzEJ8uVGwdj/130921.htmlPE
https://secure.comodo.com/CPS0
http://crl.entrust.net/2048ca.crl0

Dropped files

Name File Type Hashes Detection
C:\ProgramData\www1.dll
HTML document, ASCII text, with very long lines
#
C:\ProgramData\www3.dll
HTML document, UTF-8 Unicode text, with CRLF line terminators
#
C:\ProgramData\www4.dll
HTML document, ASCII text, with very long lines
#
Click to see the 16 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{C9C61CB4-AA54-4D1D-A472-514E047583D2}.tmp
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Local\Temp\~DF26415DDA42946BBE.TMP
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Local\Temp\~DF77272A7F6F18B150.TMP
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Roaming\www.ps1
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\www.txt
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{CEA04FE6-8D47-46DE-880E-C9FDF00950BC}.tmp
data
#
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
data
#
C:\Users\user\AppData\Local\Temp\~DF17CD00BA0C1E5190.TMP
data
#
C:\Users\user\AppData\Local\Temp\~DF591C17C8C82AFF5A.TMP
data
#
C:\Users\user\AppData\Local\Temp\~DFE56B344EF3200177.TMP
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\sample.doc.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Nov 26 01:39:16 2021, mtime=Fri Nov 26 01:39:16 2021, atime=Fri Nov 26 01:39:20 2021, length=229888, window=hide
#
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)
data
#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CDOKOHSTDD9BH9UY8W35.temp
data
#
C:\Users\user\Desktop\~$mple.doc.doc
data
#