Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | April 28, 2021, 9:42 a.m. | April 28, 2021, 9:58 a.m. |
-
WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\c.dot
8024
IP Address | Status | Action |
---|---|---|
129.226.160.219 | Active | Moloch |
164.124.101.2 | Active | Moloch |
172.217.25.14 | Active | Moloch |
182.50.132.242 | Active | Moloch |
188.93.150.60 | Active | Moloch |
198.185.159.145 | Active | Moloch |
23.227.38.74 | Active | Moloch |
23.95.122.25 | Active | Moloch |
34.102.136.180 | Active | Moloch |
52.58.78.16 | Active | Moloch |
72.251.224.90 | Active | Moloch |
Suricata Alerts
Suricata TLS
No Suricata TLS
suspicious_features | Connection to IP address | suspicious_request | GET http://23.95.122.25/c/vbc.exe | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.thebluefishhotel.net/qjnt/?5j=QMUGPevhnI2Yp74JHEVzH6HtR6H2zoEQzpkVeMV2m2AjEhovI/wxUE2mGeKCbnOUy7J9Z//U&vTdDF=LJBx | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.forrealmodels.com/qjnt/?5j=/8UA4kKoPYWid4Wy4SiZil89tJjdT7ic7hTrtZ5fAe41kMJ49sOOTLg7IOgO80aghp25g4RJ&vTdDF=LJBx | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.frotaconceitos.com/qjnt/?5j=SklQbBNIGDp60jmvc81YaO0+TakJjqFF7kfS9N7pp+kjm4De+jDioVGollGezL8QEhW81teu&vTdDF=LJBx | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.startrekepisode.com/qjnt/?5j=5+BnPckFTRrJGxaMVUv0BF1FKPa8eJDIfTmAxOSqxwEOI5f2tl64h5cJxkg2lQOsq3TBX7Br&vTdDF=LJBx | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.graniteinaminute.com/qjnt/?5j=Kc40ChrvGMsz5sDUgJdI1Tm80ndRwqOobrZe5CnH/KVtq0OHhWuXcnL+C6x+hGBLT8rXGqGg&vTdDF=LJBx | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.xn--jpr220deud640b.com/qjnt/?5j=jCTS+G1v0GO0ffaNHB4bN1x+uxcHkkGvZyQiwKE+/XJ/MeCy3/lhGRbiqne2xOkH/Blgq97x&vTdDF=LJBx | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.warriornotesgolbalprayer.com/qjnt/?5j=NZEjDeTbQWI4t+jLVj6ckcPfHkTvqBwW1gJjjcociDWZiHYNHkrr42q5Qu5MGWq/DbzHTKzP&vTdDF=LJBx | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.akerii.com/qjnt/?5j=kSZZl6jWs3Sc3KX4sFYto2o1JEu4hGi+VMhwGPIJktQ5K/I5FgrvGI5WQKi2EBcGxzW2rAmT&vTdDF=LJBx | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.rivcodevelopment.com/qjnt/?5j=8NBAzZEp5T2EoF9wMDQ69YhjG3fhuSs/Y3qkwEtmFVQU29n+5biQRN67qVAa42W8gpsiaP+Q&vTdDF=LJBx | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.gailrichardson.com/qjnt/?5j=cQpYuVHVGObCoOy3oJObHgw0bCNAclVj5U/7sRdD/qRSo/tXEB2YKGAusTd/rcUBeGIQZ61D&vTdDF=LJBx | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.relaxxation.com/qjnt/?5j=mxaFhsYpdbWAcRjreClqDIL9OHFKPqnw/WaD4R8v0Y7MiHTOLhCg3x68N9MAlpNWynvCyQkZ&vTdDF=LJBx | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.buckhead-meat.com/qjnt/?5j=/eERDYDYg8Pjpk/w148+Jv3JxRRGqAllXY9DrwYjMBHW71fIc6WywKuPNHthuS6BfUUI+/zo&vTdDF=LJBx |
request | GET http://23.95.122.25/c/vbc.exe |
request | POST http://www.thebluefishhotel.net/qjnt/ |
request | GET http://www.thebluefishhotel.net/qjnt/?5j=QMUGPevhnI2Yp74JHEVzH6HtR6H2zoEQzpkVeMV2m2AjEhovI/wxUE2mGeKCbnOUy7J9Z//U&vTdDF=LJBx |
request | POST http://www.forrealmodels.com/qjnt/ |
request | GET http://www.forrealmodels.com/qjnt/?5j=/8UA4kKoPYWid4Wy4SiZil89tJjdT7ic7hTrtZ5fAe41kMJ49sOOTLg7IOgO80aghp25g4RJ&vTdDF=LJBx |
request | POST http://www.frotaconceitos.com/qjnt/ |
request | GET http://www.frotaconceitos.com/qjnt/?5j=SklQbBNIGDp60jmvc81YaO0+TakJjqFF7kfS9N7pp+kjm4De+jDioVGollGezL8QEhW81teu&vTdDF=LJBx |
request | POST http://www.startrekepisode.com/qjnt/ |
request | GET http://www.startrekepisode.com/qjnt/?5j=5+BnPckFTRrJGxaMVUv0BF1FKPa8eJDIfTmAxOSqxwEOI5f2tl64h5cJxkg2lQOsq3TBX7Br&vTdDF=LJBx |
request | POST http://www.graniteinaminute.com/qjnt/ |
request | GET http://www.graniteinaminute.com/qjnt/?5j=Kc40ChrvGMsz5sDUgJdI1Tm80ndRwqOobrZe5CnH/KVtq0OHhWuXcnL+C6x+hGBLT8rXGqGg&vTdDF=LJBx |
request | POST http://www.xn--jpr220deud640b.com/qjnt/ |
request | GET http://www.xn--jpr220deud640b.com/qjnt/?5j=jCTS+G1v0GO0ffaNHB4bN1x+uxcHkkGvZyQiwKE+/XJ/MeCy3/lhGRbiqne2xOkH/Blgq97x&vTdDF=LJBx |
request | POST http://www.warriornotesgolbalprayer.com/qjnt/ |
request | GET http://www.warriornotesgolbalprayer.com/qjnt/?5j=NZEjDeTbQWI4t+jLVj6ckcPfHkTvqBwW1gJjjcociDWZiHYNHkrr42q5Qu5MGWq/DbzHTKzP&vTdDF=LJBx |
request | POST http://www.akerii.com/qjnt/ |
request | GET http://www.akerii.com/qjnt/?5j=kSZZl6jWs3Sc3KX4sFYto2o1JEu4hGi+VMhwGPIJktQ5K/I5FgrvGI5WQKi2EBcGxzW2rAmT&vTdDF=LJBx |
request | POST http://www.rivcodevelopment.com/qjnt/ |
request | GET http://www.rivcodevelopment.com/qjnt/?5j=8NBAzZEp5T2EoF9wMDQ69YhjG3fhuSs/Y3qkwEtmFVQU29n+5biQRN67qVAa42W8gpsiaP+Q&vTdDF=LJBx |
request | POST http://www.gailrichardson.com/qjnt/ |
request | GET http://www.gailrichardson.com/qjnt/?5j=cQpYuVHVGObCoOy3oJObHgw0bCNAclVj5U/7sRdD/qRSo/tXEB2YKGAusTd/rcUBeGIQZ61D&vTdDF=LJBx |
request | POST http://www.relaxxation.com/qjnt/ |
request | GET http://www.relaxxation.com/qjnt/?5j=mxaFhsYpdbWAcRjreClqDIL9OHFKPqnw/WaD4R8v0Y7MiHTOLhCg3x68N9MAlpNWynvCyQkZ&vTdDF=LJBx |
request | POST http://www.buckhead-meat.com/qjnt/ |
request | GET http://www.buckhead-meat.com/qjnt/?5j=/eERDYDYg8Pjpk/w148+Jv3JxRRGqAllXY9DrwYjMBHW71fIc6WywKuPNHthuS6BfUUI+/zo&vTdDF=LJBx |
request | POST http://www.thebluefishhotel.net/qjnt/ |
request | POST http://www.forrealmodels.com/qjnt/ |
request | POST http://www.frotaconceitos.com/qjnt/ |
request | POST http://www.startrekepisode.com/qjnt/ |
request | POST http://www.graniteinaminute.com/qjnt/ |
request | POST http://www.xn--jpr220deud640b.com/qjnt/ |
request | POST http://www.warriornotesgolbalprayer.com/qjnt/ |
request | POST http://www.akerii.com/qjnt/ |
request | POST http://www.rivcodevelopment.com/qjnt/ |
request | POST http://www.gailrichardson.com/qjnt/ |
request | POST http://www.relaxxation.com/qjnt/ |
request | POST http://www.buckhead-meat.com/qjnt/ |
filetype_details | Rich Text Format data, unknown version | filename | c.dot |
host | 172.217.25.14 | |||
host | 23.95.122.25 |
MicroWorld-eScan | Exploit.RTF-ObfsStrm.Gen |
FireEye | Exploit.RTF-ObfsStrm.Gen |
CAT-QuickHeal | Exp.RTF.Obfus.Gen |
McAfee | Exploit-CVE2017-11882.bw |
Sangfor | Exploit.Generic-Script.Save.e1f6df4c |
K7AntiVirus | Trojan ( 0057b3a91 ) |
K7GW | Trojan ( 0057b3a91 ) |
Cyren | RTF/CVE-2017-11882.N.gen!Camelot |
Symantec | Bloodhound.RTF.20 |
ESET-NOD32 | multiple detections |
Kaspersky | UDS:DangerousObject.Multi.Generic |
BitDefender | Exploit.RTF-ObfsStrm.Gen |
NANO-Antivirus | Exploit.Rtf.Heuristic-rtf.dinbqn |
Ad-Aware | Exploit.RTF-ObfsStrm.Gen |
Emsisoft | Exploit.RTF-ObfsStrm.Gen (B) |
TrendMicro | HEUR_RTFMALFORM |
McAfee-GW-Edition | Exploit-CVE2017-11882.bw |
Ikarus | Exploit.CVE-2017-11882 |
Avira | HEUR/Rtf.Malformed |
Arcabit | Exploit.RTF-ObfsStrm.Gen |
ZoneAlarm | HEUR:Exploit.MSOffice.Generic |
GData | Exploit.RTF-ObfsStrm.Gen |
Cynet | Malicious (score: 99) |
AhnLab-V3 | RTF/Malform-A.Gen |
Zoner | Probably Heur.RTFBadVersion |
MAX | malware (ai score=87) |
Fortinet | RTF/CVE_2017_11882.C!exploit |