popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

invc_009030009.wbk

doc RTF File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 18, 2021, 5:53 p.m. Oct. 18, 2021, 5:56 p.m.
Size 26.3KB
Type Rich Text Format data, unknown version
MD5 ea27c453801a76553e850c260b6a288b
SHA256 6a63e0f1a5b6452177c765321511e6c1363eba770d21d88adf5e067860f93ee1
CRC32 27B343D7
ssdeep 384:T5feL1cEWAaJYAp85iOoh/O15+NEbXBJBLntuQpVcbxh3a4iU2ScUYU8oEJSYScn:TkLvSp8/eEl7YQ8r1iU0UNE5
Yara
  • Rich_Text_Format_Zero - Rich Text Format Signature Zero

Name Response Post-Analysis Lookup
www.revgeek.com
A 156.234.138.23
156.234.138.23
www.normandia.pro
A 170.178.168.203
70.32.1.32
www.safebookkeeping.com
A 208.113.163.16
208.113.163.16
www.whitebot.xyz
A 172.104.153.244
CNAME whitebot.xyz
172.104.153.244
www.jellyice-tr.com
A 172.67.173.247
A 104.21.30.231
104.21.30.231
www.brandonhistoryandinfo.com
A 34.102.136.180
CNAME brandonhistoryandinfo.com
34.102.136.180
www.mortgagerates.solutions
A 64.190.62.111
64.190.62.111
www.naplesconciergerealty.com
CNAME naplesconciergerealty.com
A 34.102.136.180
34.102.136.180
www.onehigh.club
A 209.99.64.33
209.99.64.33
www.ingdalynnia.xyz
A 173.212.200.118
CNAME ingdalynnia.xyz
173.212.200.118
www.closetu.com
CNAME HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com
A 3.223.115.185
3.223.115.185
www.historyofcambridge.com
CNAME HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com
A 3.223.115.185
3.223.115.185
www.sattaking-gaziabad.xyz
CNAME sattaking-gaziabad.xyz
A 185.28.21.80
185.28.21.80
www.desongli.com
A 108.186.180.79
108.186.180.79
www.tbrhc.com
A 154.208.173.145
154.208.173.145
IP Address Status Action
104.21.30.231 Active Moloch
108.186.180.79 Active Moloch
154.208.173.145 Active Moloch
156.234.138.23 Active Moloch
164.124.101.2 Active Moloch
170.178.168.203 Active Moloch
172.104.153.244 Active Moloch
173.212.200.118 Active Moloch
185.28.21.80 Active Moloch
192.3.110.172 Active Moloch
208.113.163.16 Active Moloch
209.99.64.33 Active Moloch
3.223.115.185 Active Moloch
34.102.136.180 Active Moloch
64.190.62.111 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49201 -> 192.3.110.172:80 2016141 ET INFO Executable Download from dotted-quad Host A Network Trojan was detected
TCP 192.168.56.101:49201 -> 192.3.110.172:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.3.110.172:80 -> 192.168.56.101:49201 2022050 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 A Network Trojan was detected
TCP 192.168.56.101:49231 -> 185.28.21.80:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49221 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49231 -> 185.28.21.80:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49233 -> 173.212.200.118:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49221 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49233 -> 173.212.200.118:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49231 -> 185.28.21.80:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49221 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49233 -> 173.212.200.118:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49231 -> 185.28.21.80:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.101:49233 -> 173.212.200.118:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.3.110.172:80 -> 192.168.56.101:49201 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.3.110.172:80 -> 192.168.56.101:49201 2022051 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 A Network Trojan was detected
TCP 192.3.110.172:80 -> 192.168.56.101:49201 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49217 -> 172.104.153.244:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49237 -> 156.234.138.23:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 172.104.153.244:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 172.104.153.244:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49237 -> 156.234.138.23:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 172.104.153.244:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.101:49237 -> 156.234.138.23:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49226 -> 209.99.64.33:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49226 -> 209.99.64.33:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49226 -> 209.99.64.33:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 154.208.173.145:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 154.208.173.145:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 154.208.173.145:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 170.178.168.203:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 170.178.168.203:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 170.178.168.203:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 108.186.180.79:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 108.186.180.79:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 108.186.180.79:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 64.190.62.111:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 64.190.62.111:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 3.223.115.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 64.190.62.111:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 3.223.115.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 3.223.115.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49229 -> 208.113.163.16:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49229 -> 208.113.163.16:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49229 -> 208.113.163.16:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49235 -> 3.223.115.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49235 -> 3.223.115.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49235 -> 3.223.115.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49239 -> 104.21.30.231:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49239 -> 104.21.30.231:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49239 -> 104.21.30.231:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x6fee4dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x704b92a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x70738232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x7094c40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x7095699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x7073a206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x704bb9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x7041f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x6fb825f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x6fbafe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x6fbaf54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x7071e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x706d168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x6fb6a431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x6fb5876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x6fb549e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fa915d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fa9155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3295724
registers.edi: 1957755408
registers.eax: 3295724
registers.ebp: 3295804
registers.edx: 0
registers.ebx: 6099316
registers.esi: 2147944126
registers.ecx: 3945087591
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x6fee4dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x704b92a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x70738232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x7094c40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x7095699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x7073a206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x704bb9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x7041f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x6fb825f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x6fbafe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x6fbaf54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x7071e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x706d168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x6fb6a431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x6fb5876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x6fb549e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fa915d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fa9155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3295416
registers.edi: 1957755408
registers.eax: 3295416
registers.ebp: 3295496
registers.edx: 0
registers.ebx: 6099532
registers.esi: 2147944122
registers.ecx: 3945087591
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://192.3.110.172/006600066/vbc.exe
suspicious_features GET method with no useragent header suspicious_request GET http://www.desongli.com/mxnu/?ytsDIrP=hZ80obWBB1Dtx9mJDJ/B6KhSbXm9N4IXZ9kDZpitpQpTEQWdqR+8a/o3g7qjE+O8VqYt5r7Y&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.closetu.com/mxnu/?ytsDIrP=rJ249TMVQMCwGwXS7eMNhvOWH4SbGXiKs4Vq1JHmstm/5V4DyV8c/XoA/4BgaERVtEbRuzyC&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.tbrhc.com/mxnu/?ytsDIrP=dBbPwQ2utUd0Fk1uS+XSFkxz2YTUNCneFR1VLIh1vAwAXkSpHWWkzNznjyqcoekG5m5H1qts&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.naplesconciergerealty.com/mxnu/?ytsDIrP=hecv2sMFcvsyFIpzJOhZbtwMh1SG6St5/U1aPglBFWownzq2qPNpvMi/ho6Sg43JWpVw027R&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.whitebot.xyz/mxnu/?ytsDIrP=mJKlLoR4AxZK/RYIFKAo0UiVtoPyzBJ6SQAFXLfvSOBYEGo1cqGoAX7CRK1QxANrckFntybM&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.mortgagerates.solutions/mxnu/?ytsDIrP=e40TMWWr6xWVnQ1HwCqLobeJF4L/Z7xCu7/MTKlaRXTCRzwsua34O9neh9w9TPhFkJc6vnSR&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.brandonhistoryandinfo.com/mxnu/?ytsDIrP=TBa+b5mpCdI4y/h180Pl2gJXBklETz7DPBwfCQzHJDv5/wBYQn0JU1W1LmmZ4xHxKrhvcr9L&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.normandia.pro/mxnu/?ytsDIrP=kHN/hbjK4OzLmo333toUUHv3cKFKy5bivtfKIua2AYmutZDuFn6HD/HyblDUos2+bUTS6mEe&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.onehigh.club/mxnu/?ytsDIrP=52TJ8f0Vxw2BzXpbfWSfaWlDTRlua2mq3mQuHpcP7nL3PE2hO33OHCZ6ItQZVKuqvI9FSTzz&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.safebookkeeping.com/mxnu/?ytsDIrP=Dinuu19hFboSFju1K0HZ6EbcdDMO+ZnQ9sDSjm9DAS1j/pnpew28zT8+4dAfvZHXXiVk+x1O&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.sattaking-gaziabad.xyz/mxnu/?ytsDIrP=UvUEtIev0LW0Fj9rimgEuaxF8o8Q3PSD9GE10acJUnczNTSiUTsn1kpqflxWWG28G9vjgVED&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.ingdalynnia.xyz/mxnu/?ytsDIrP=pfZfepvuuXd3YdzLhx74JhtQE2ZsQUx19b2XlYunhcRs71ErzSq2ECWFO+pn1SXrM1L87AtC&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.historyofcambridge.com/mxnu/?ytsDIrP=83rAwycDMUEJxLGVulxgJoLHCAQKcanhrm8XweUEKHeaWBLa77jLvzg0UgbAuk5RNaMObh69&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.revgeek.com/mxnu/?ytsDIrP=LFHT7yJDHTG5j2x991585jkXyYBkZkjzIUaPFc8bTKfmXG7pnxx1T4PiHIQyjDj8X+wed1XV&JlM=tnt48PpXYxvL
suspicious_features GET method with no useragent header suspicious_request GET http://www.jellyice-tr.com/mxnu/?ytsDIrP=2jYCrBsbpe7TX9aPhZM9pCxr75im0gQU84tPJTFdoXWJ8jmtmSvNbVsQgFqr9XIl+R+lpCoE&JlM=tnt48PpXYxvL
request GET http://192.3.110.172/006600066/vbc.exe
request POST http://www.desongli.com/mxnu/
request GET http://www.desongli.com/mxnu/?ytsDIrP=hZ80obWBB1Dtx9mJDJ/B6KhSbXm9N4IXZ9kDZpitpQpTEQWdqR+8a/o3g7qjE+O8VqYt5r7Y&JlM=tnt48PpXYxvL
request POST http://www.closetu.com/mxnu/
request GET http://www.closetu.com/mxnu/?ytsDIrP=rJ249TMVQMCwGwXS7eMNhvOWH4SbGXiKs4Vq1JHmstm/5V4DyV8c/XoA/4BgaERVtEbRuzyC&JlM=tnt48PpXYxvL
request POST http://www.tbrhc.com/mxnu/
request GET http://www.tbrhc.com/mxnu/?ytsDIrP=dBbPwQ2utUd0Fk1uS+XSFkxz2YTUNCneFR1VLIh1vAwAXkSpHWWkzNznjyqcoekG5m5H1qts&JlM=tnt48PpXYxvL
request POST http://www.naplesconciergerealty.com/mxnu/
request GET http://www.naplesconciergerealty.com/mxnu/?ytsDIrP=hecv2sMFcvsyFIpzJOhZbtwMh1SG6St5/U1aPglBFWownzq2qPNpvMi/ho6Sg43JWpVw027R&JlM=tnt48PpXYxvL
request POST http://www.whitebot.xyz/mxnu/
request GET http://www.whitebot.xyz/mxnu/?ytsDIrP=mJKlLoR4AxZK/RYIFKAo0UiVtoPyzBJ6SQAFXLfvSOBYEGo1cqGoAX7CRK1QxANrckFntybM&JlM=tnt48PpXYxvL
request POST http://www.mortgagerates.solutions/mxnu/
request GET http://www.mortgagerates.solutions/mxnu/?ytsDIrP=e40TMWWr6xWVnQ1HwCqLobeJF4L/Z7xCu7/MTKlaRXTCRzwsua34O9neh9w9TPhFkJc6vnSR&JlM=tnt48PpXYxvL
request POST http://www.brandonhistoryandinfo.com/mxnu/
request GET http://www.brandonhistoryandinfo.com/mxnu/?ytsDIrP=TBa+b5mpCdI4y/h180Pl2gJXBklETz7DPBwfCQzHJDv5/wBYQn0JU1W1LmmZ4xHxKrhvcr9L&JlM=tnt48PpXYxvL
request POST http://www.normandia.pro/mxnu/
request GET http://www.normandia.pro/mxnu/?ytsDIrP=kHN/hbjK4OzLmo333toUUHv3cKFKy5bivtfKIua2AYmutZDuFn6HD/HyblDUos2+bUTS6mEe&JlM=tnt48PpXYxvL
request POST http://www.onehigh.club/mxnu/
request GET http://www.onehigh.club/mxnu/?ytsDIrP=52TJ8f0Vxw2BzXpbfWSfaWlDTRlua2mq3mQuHpcP7nL3PE2hO33OHCZ6ItQZVKuqvI9FSTzz&JlM=tnt48PpXYxvL
request POST http://www.safebookkeeping.com/mxnu/
request GET http://www.safebookkeeping.com/mxnu/?ytsDIrP=Dinuu19hFboSFju1K0HZ6EbcdDMO+ZnQ9sDSjm9DAS1j/pnpew28zT8+4dAfvZHXXiVk+x1O&JlM=tnt48PpXYxvL
request POST http://www.sattaking-gaziabad.xyz/mxnu/
request GET http://www.sattaking-gaziabad.xyz/mxnu/?ytsDIrP=UvUEtIev0LW0Fj9rimgEuaxF8o8Q3PSD9GE10acJUnczNTSiUTsn1kpqflxWWG28G9vjgVED&JlM=tnt48PpXYxvL
request POST http://www.ingdalynnia.xyz/mxnu/
request GET http://www.ingdalynnia.xyz/mxnu/?ytsDIrP=pfZfepvuuXd3YdzLhx74JhtQE2ZsQUx19b2XlYunhcRs71ErzSq2ECWFO+pn1SXrM1L87AtC&JlM=tnt48PpXYxvL
request POST http://www.historyofcambridge.com/mxnu/
request GET http://www.historyofcambridge.com/mxnu/?ytsDIrP=83rAwycDMUEJxLGVulxgJoLHCAQKcanhrm8XweUEKHeaWBLa77jLvzg0UgbAuk5RNaMObh69&JlM=tnt48PpXYxvL
request POST http://www.revgeek.com/mxnu/
request GET http://www.revgeek.com/mxnu/?ytsDIrP=LFHT7yJDHTG5j2x991585jkXyYBkZkjzIUaPFc8bTKfmXG7pnxx1T4PiHIQyjDj8X+wed1XV&JlM=tnt48PpXYxvL
request POST http://www.jellyice-tr.com/mxnu/
request GET http://www.jellyice-tr.com/mxnu/?ytsDIrP=2jYCrBsbpe7TX9aPhZM9pCxr75im0gQU84tPJTFdoXWJ8jmtmSvNbVsQgFqr9XIl+R+lpCoE&JlM=tnt48PpXYxvL
request POST http://www.desongli.com/mxnu/
request POST http://www.closetu.com/mxnu/
request POST http://www.tbrhc.com/mxnu/
request POST http://www.naplesconciergerealty.com/mxnu/
request POST http://www.whitebot.xyz/mxnu/
request POST http://www.mortgagerates.solutions/mxnu/
request POST http://www.brandonhistoryandinfo.com/mxnu/
request POST http://www.normandia.pro/mxnu/
request POST http://www.onehigh.club/mxnu/
request POST http://www.safebookkeeping.com/mxnu/
request POST http://www.sattaking-gaziabad.xyz/mxnu/
request POST http://www.ingdalynnia.xyz/mxnu/
request POST http://www.historyofcambridge.com/mxnu/
request POST http://www.revgeek.com/mxnu/
request POST http://www.jellyice-tr.com/mxnu/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x65001000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6ca01000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1108
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05d40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1108
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05d40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1108
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05d50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1108
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05d60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c941000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c944000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x507c1000
process_handle: 0xffffffff
1 0 0
Application Crash Process WINWORD.EXE with pid 1108 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x6fee4dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x704b92a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x70738232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x7094c40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x7095699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x7073a206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x704bb9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x7041f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x6fb825f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x6fbafe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x6fbaf54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x7071e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x706d168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x6fb6a431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x6fb5876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x6fb549e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fa915d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fa9155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3295724
registers.edi: 1957755408
registers.eax: 3295724
registers.ebp: 3295804
registers.edx: 0
registers.ebx: 6099316
registers.esi: 2147944126
registers.ecx: 3945087591
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x6fee4dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x704b92a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x70738232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x7094c40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x7095699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x7073a206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x704bb9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x7041f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x6fb825f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x6fbafe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x6fbaf54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x7071e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x706d168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x6fb6a431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x6fb5876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x6fb549e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fa915d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fa9155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3295416
registers.edi: 1957755408
registers.eax: 3295416
registers.ebp: 3295496
registers.edx: 0
registers.ebx: 6099532
registers.esi: 2147944122
registers.ecx: 3945087591
1 0 0
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x000003ec
filepath: C:\Users\test22\AppData\Local\Temp\~$vc_009030009.wbk
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$vc_009030009.wbk
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
filetype_details Rich Text Format data, unknown version filename invc_009030009.wbk
host 192.3.110.172