Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | April 14, 2021, 8:02 a.m. | April 14, 2021, 8:05 a.m. |
-
WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\..................................................................dot
732
IP Address | Status | Action |
---|---|---|
162.241.216.98 | Active | Moloch |
162.241.80.12 | Active | Moloch |
164.124.101.2 | Active | Moloch |
182.50.132.242 | Active | Moloch |
23.227.38.74 | Active | Moloch |
23.95.122.25 | Active | Moloch |
34.102.136.180 | Active | Moloch |
45.39.88.198 | Active | Moloch |
50.118.194.27 | Active | Moloch |
52.58.78.16 | Active | Moloch |
74.208.236.55 | Active | Moloch |
Suricata Alerts
Suricata TLS
No Suricata TLS
suspicious_features | Connection to IP address | suspicious_request | GET http://23.95.122.25/hd/vbc.exe | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.libertyss.com/qjnt/?MZkp=T4Dbya7zRkj16kTLtWUPXPtW5SPliNL4iZJFD7KCtGJwUlsdNK5uEwEJh9hz3AP36X7VeJEk&U4kp=Ntx0ULGP4BTDMV0 | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.frotaconceitos.com/qjnt/?MZkp=SklQbBNIGDp60jmvc81YaO0+TakJjqFF7kfS9N7pp+kjm4De+jDioVGollGezL8QEhW81teu&U4kp=Ntx0ULGP4BTDMV0 | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.gailrichardson.com/qjnt/?MZkp=cQpYuVHVGObCoOy3oJObHgw0bCNAclVj5U/7sRdD/qRSo/tXEB2YKGAusTd/rcUBeGIQZ61D&U4kp=Ntx0ULGP4BTDMV0 | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.crochenista.com/qjnt/?MZkp=J6zJO2/PwCYDrPfd6ahXoqg8qe3TXVYRwNW46sX1F3TUCNiZ+HIDBehPRyNHfGKllpDSpMGn&U4kp=Ntx0ULGP4BTDMV0 | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.frienzmusic.com/qjnt/?MZkp=dDSt6GS+2NiAQr9aRgBajSU7AtJ5Qx8lN5XbL7DZCOVbMbdHey2pr7C5pxf0UzYLijUZ73r2&U4kp=Ntx0ULGP4BTDMV0 | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.warriormovers.com/qjnt/?MZkp=ZloBTpog1XpNf+wk1FYIj/PbKl44EdMQG0QlJcdkzx7vf5IbO8Fhxe+U6jjqYB73pzbLmZvg&U4kp=Ntx0ULGP4BTDMV0 | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.eoapdj.com/qjnt/?MZkp=tDoVZ8LrXdfM2UePKwC2rJ8resXPJc2dnDhd6WgKQtKZKBlahDoyQOcxbwTJkNKzfSZAVv0R&U4kp=Ntx0ULGP4BTDMV0 | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.investiose.info/qjnt/?MZkp=ZxcvZy8ZLczqtvfEla7uZ1L3KAM6BWVTFYDKbjT+DQ7ivFAcZk5kBU1oTK1xQfOK60beZP/V&U4kp=Ntx0ULGP4BTDMV0 | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.graniteinaminute.com/qjnt/?MZkp=Kc40ChrvGMsz5sDUgJdI1Tm80ndRwqOobrZe5CnH/KVtq0OHhWuXcnL+C6x+hGBLT8rXGqGg&U4kp=Ntx0ULGP4BTDMV0 | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.phenomlearning.com/qjnt/?MZkp=WI8JaetFPlzEEOGlHcuNECQ5ajgQYI90CCACSj2nuajKFDjgs1eXlKD9lsoYQqmcwsae0cVZ&U4kp=Ntx0ULGP4BTDMV0 | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.qs-industrial.com/qjnt/?MZkp=Trcx7sIz3LbBEBUCXdOp/eOytLuMV8hMNa+9OSM+DuhSXGbAh0UZQVrA5aZ/AO5e9Gzf6ou7&U4kp=Ntx0ULGP4BTDMV0 |
request | GET http://23.95.122.25/hd/vbc.exe |
request | POST http://www.libertyss.com/qjnt/ |
request | GET http://www.libertyss.com/qjnt/?MZkp=T4Dbya7zRkj16kTLtWUPXPtW5SPliNL4iZJFD7KCtGJwUlsdNK5uEwEJh9hz3AP36X7VeJEk&U4kp=Ntx0ULGP4BTDMV0 |
request | POST http://www.frotaconceitos.com/qjnt/ |
request | GET http://www.frotaconceitos.com/qjnt/?MZkp=SklQbBNIGDp60jmvc81YaO0+TakJjqFF7kfS9N7pp+kjm4De+jDioVGollGezL8QEhW81teu&U4kp=Ntx0ULGP4BTDMV0 |
request | POST http://www.gailrichardson.com/qjnt/ |
request | GET http://www.gailrichardson.com/qjnt/?MZkp=cQpYuVHVGObCoOy3oJObHgw0bCNAclVj5U/7sRdD/qRSo/tXEB2YKGAusTd/rcUBeGIQZ61D&U4kp=Ntx0ULGP4BTDMV0 |
request | POST http://www.crochenista.com/qjnt/ |
request | GET http://www.crochenista.com/qjnt/?MZkp=J6zJO2/PwCYDrPfd6ahXoqg8qe3TXVYRwNW46sX1F3TUCNiZ+HIDBehPRyNHfGKllpDSpMGn&U4kp=Ntx0ULGP4BTDMV0 |
request | POST http://www.frienzmusic.com/qjnt/ |
request | GET http://www.frienzmusic.com/qjnt/?MZkp=dDSt6GS+2NiAQr9aRgBajSU7AtJ5Qx8lN5XbL7DZCOVbMbdHey2pr7C5pxf0UzYLijUZ73r2&U4kp=Ntx0ULGP4BTDMV0 |
request | POST http://www.warriormovers.com/qjnt/ |
request | GET http://www.warriormovers.com/qjnt/?MZkp=ZloBTpog1XpNf+wk1FYIj/PbKl44EdMQG0QlJcdkzx7vf5IbO8Fhxe+U6jjqYB73pzbLmZvg&U4kp=Ntx0ULGP4BTDMV0 |
request | POST http://www.eoapdj.com/qjnt/ |
request | GET http://www.eoapdj.com/qjnt/?MZkp=tDoVZ8LrXdfM2UePKwC2rJ8resXPJc2dnDhd6WgKQtKZKBlahDoyQOcxbwTJkNKzfSZAVv0R&U4kp=Ntx0ULGP4BTDMV0 |
request | POST http://www.investiose.info/qjnt/ |
request | GET http://www.investiose.info/qjnt/?MZkp=ZxcvZy8ZLczqtvfEla7uZ1L3KAM6BWVTFYDKbjT+DQ7ivFAcZk5kBU1oTK1xQfOK60beZP/V&U4kp=Ntx0ULGP4BTDMV0 |
request | POST http://www.graniteinaminute.com/qjnt/ |
request | GET http://www.graniteinaminute.com/qjnt/?MZkp=Kc40ChrvGMsz5sDUgJdI1Tm80ndRwqOobrZe5CnH/KVtq0OHhWuXcnL+C6x+hGBLT8rXGqGg&U4kp=Ntx0ULGP4BTDMV0 |
request | POST http://www.phenomlearning.com/qjnt/ |
request | GET http://www.phenomlearning.com/qjnt/?MZkp=WI8JaetFPlzEEOGlHcuNECQ5ajgQYI90CCACSj2nuajKFDjgs1eXlKD9lsoYQqmcwsae0cVZ&U4kp=Ntx0ULGP4BTDMV0 |
request | POST http://www.qs-industrial.com/qjnt/ |
request | GET http://www.qs-industrial.com/qjnt/?MZkp=Trcx7sIz3LbBEBUCXdOp/eOytLuMV8hMNa+9OSM+DuhSXGbAh0UZQVrA5aZ/AO5e9Gzf6ou7&U4kp=Ntx0ULGP4BTDMV0 |
request | POST http://www.libertyss.com/qjnt/ |
request | POST http://www.frotaconceitos.com/qjnt/ |
request | POST http://www.gailrichardson.com/qjnt/ |
request | POST http://www.crochenista.com/qjnt/ |
request | POST http://www.frienzmusic.com/qjnt/ |
request | POST http://www.warriormovers.com/qjnt/ |
request | POST http://www.eoapdj.com/qjnt/ |
request | POST http://www.investiose.info/qjnt/ |
request | POST http://www.graniteinaminute.com/qjnt/ |
request | POST http://www.phenomlearning.com/qjnt/ |
request | POST http://www.qs-industrial.com/qjnt/ |
filetype_details | Rich Text Format data, unknown version | filename | ..................................................................dot |
host | 23.95.122.25 |
CAT-QuickHeal | Exp.RTF.Obfus.Gen |
McAfee | Exploit-CVE2017-11882.bw |
Arcabit | Exploit.RTF-ObfsObjDat.Gen |
Symantec | Exp.CVE-2017-11882!g2 |
ESET-NOD32 | multiple detections |
Avast | Other:Malware-gen [Trj] |
Cynet | Malicious (score: 99) |
Kaspersky | UDS:DangerousObject.Multi.Generic |
BitDefender | Exploit.RTF-ObfsObjDat.Gen |
NANO-Antivirus | Exploit.Rtf.Heuristic-rtf.dinbqn |
MicroWorld-eScan | Exploit.RTF-ObfsObjDat.Gen |
Ad-Aware | Exploit.RTF-ObfsObjDat.Gen |
Emsisoft | Exploit.RTF-ObfsObjDat.Gen (B) |
F-Secure | Heuristic.HEUR/Rtf.Malformed |
DrWeb | Exploit.Rtf.Obfuscated.32 |
TrendMicro | HEUR_RTFMALFORM |
McAfee-GW-Edition | Exploit-CVE2017-11882.bw |
FireEye | Exploit.RTF-ObfsObjDat.Gen |
Avira | HEUR/Rtf.Malformed |
GData | Exploit.RTF-ObfsObjDat.Gen |
AhnLab-V3 | RTF/Malform-A.Gen |
ALYac | Exploit.RTF-ObfsObjDat.Gen |
MAX | malware (ai score=85) |
Zoner | Probably Heur.RTFBadVersion |
Fortinet | RTF/CVE_2017_11882.E!exploit |
AVG | Other:Malware-gen [Trj] |
Qihoo-360 | susp.rtf.objupdate.gen |