popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

invc_000002340003032030.wbk

doc RTF File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 3, 2021, 7:59 a.m. Nov. 3, 2021, 8:01 a.m.
Size 26.7KB
Type Rich Text Format data, unknown version
MD5 4da8c38808017d5f01ba220a5e02944a
SHA256 4d93f2c905c4bd34bbe79e8cf8e8eba3c8cc3078335ba9eb31551c3b0ba24e01
CRC32 342FF585
ssdeep 768:7+jO/O2+SZjzWPLOK15jnB6WHmUVOyRRAAntTEOYV:8R2DpzWPLOK15jnMWGdYEP
Yara
  • Rich_Text_Format_Zero - Rich Text Format Signature Zero

Name Response Post-Analysis Lookup
secure01-redirect.net
A 94.142.140.223
94.142.140.223
IP Address Status Action
164.124.101.2 Active Moloch
202.55.135.190 Active Moloch
94.142.140.223 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49167 -> 94.142.140.223:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.101:49162 -> 202.55.135.190:80 2016141 ET INFO Executable Download from dotted-quad Host A Network Trojan was detected
TCP 192.168.56.101:49167 -> 94.142.140.223:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.101:49162 -> 202.55.135.190:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.101:49165 -> 94.142.140.223:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.101:49165 -> 94.142.140.223:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 202.55.135.190:80 -> 192.168.56.101:49162 2022050 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 A Network Trojan was detected
TCP 192.168.56.101:49167 -> 94.142.140.223:80 2024313 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected
TCP 202.55.135.190:80 -> 192.168.56.101:49162 2014819 ET INFO Packed Executable Download Misc activity
TCP 192.168.56.101:49167 -> 94.142.140.223:80 2024318 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 94.142.140.223:80 2024312 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 A Network Trojan was detected
TCP 192.168.56.101:49165 -> 94.142.140.223:80 2024317 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 A Network Trojan was detected
TCP 94.142.140.223:80 -> 192.168.56.101:49167 2025483 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected
TCP 192.168.56.101:49166 -> 94.142.140.223:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.101:49170 -> 94.142.140.223:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.101:49166 -> 94.142.140.223:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 94.142.140.223:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 94.142.140.223:80 2024312 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 A Network Trojan was detected
TCP 192.168.56.101:49170 -> 94.142.140.223:80 2024313 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 94.142.140.223:80 2024317 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 A Network Trojan was detected
TCP 192.168.56.101:49170 -> 94.142.140.223:80 2024318 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected
TCP 94.142.140.223:80 -> 192.168.56.101:49170 2025483 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected
TCP 202.55.135.190:80 -> 192.168.56.101:49162 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 202.55.135.190:80 -> 192.168.56.101:49162 2022051 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 A Network Trojan was detected
TCP 202.55.135.190:80 -> 192.168.56.101:49162 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x76af374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x7691f725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x76b0414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x7691c8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x768198ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x76861414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76877b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x727b4dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x72d892a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x73008232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x7321c40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x7322699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x7300a206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x72d8b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x72cef93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x724525f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x7247fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x7247f54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x72fee418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x72fa168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x7243a431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x7242876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x724249e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2f6d15d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2f6d155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x760cb727
registers.esp: 1330456
registers.edi: 1988295184
registers.eax: 1330456
registers.ebp: 1330536
registers.edx: 0
registers.ebx: 3283940
registers.esi: 2147944126
registers.ecx: 1635948962
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x76af374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x7691f725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x76b0414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x7691c8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x768198ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x7681b641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x7681b5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x7681b172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x7681a66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x7689a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x768777e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x768614b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76877b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x727b4dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x72d892a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x73008232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x7321c40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x7322699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x7300a206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x72d8b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x72cef93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x724525f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x7247fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x7247f54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x72fee418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x72fa168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x7243a431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x7242876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x724249e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2f6d15d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2f6d155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x760cb727
registers.esp: 1330148
registers.edi: 1988295184
registers.eax: 1330148
registers.ebp: 1330228
registers.edx: 0
registers.ebx: 3284156
registers.esi: 2147944122
registers.ecx: 1635948962
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://202.55.135.190/77077/vbc.exe
suspicious_features POST method with no referer header, HTTP version 1.0 used suspicious_request POST http://secure01-redirect.net/fd11/fre.php
request GET http://202.55.135.190/77077/vbc.exe
request POST http://secure01-redirect.net/fd11/fre.php
request POST http://secure01-redirect.net/fd11/fre.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x65001000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6ec61000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2780
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05930000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2780
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05930000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2780
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05940000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2780
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05950000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e711000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e714000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x507c1000
process_handle: 0xffffffff
1 0 0
Application Crash Process WINWORD.EXE with pid 2780 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x76af374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x7691f725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x76b0414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x7691c8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x768198ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x76861414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76877b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x727b4dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x72d892a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x73008232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x7321c40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x7322699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x7300a206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x72d8b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x72cef93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x724525f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x7247fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x7247f54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x72fee418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x72fa168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x7243a431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x7242876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x724249e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2f6d15d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2f6d155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x760cb727
registers.esp: 1330456
registers.edi: 1988295184
registers.eax: 1330456
registers.ebp: 1330536
registers.edx: 0
registers.ebx: 3283940
registers.esi: 2147944126
registers.ecx: 1635948962
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x76af374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x7691f725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x76b0414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x7691c8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x768198ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x7681b641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x7681b5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x7681b172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x7681a66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x7689a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x768777e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x768614b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76877b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x727b4dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x72d892a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x73008232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x7321c40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x7322699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x7300a206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x72d8b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x72cef93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x724525f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x7247fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x7247f54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x72fee418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x72fa168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x7243a431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x7242876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x724249e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2f6d15d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2f6d155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x760cb727
registers.esp: 1330148
registers.edi: 1988295184
registers.eax: 1330148
registers.ebp: 1330228
registers.edx: 0
registers.ebx: 3284156
registers.esi: 2147944122
registers.ecx: 1635948962
1 0 0
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x000003ec
filepath: C:\Users\test22\AppData\Local\Temp\~$vc_000002340003032030.wbk
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$vc_000002340003032030.wbk
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
filetype_details Rich Text Format data, unknown version filename invc_000002340003032030.wbk
host 202.55.135.190
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
FireEye Exploit.RTF-ObfsStrm.Gen
McAfee Exploit-CVE2017-11882.z
Sangfor Malware.Generic-RTF.Save.c5a892ae
K7AntiVirus Trojan ( 0057b3a91 )
K7GW Trojan ( 0057b3a91 )
Cyren RTF/CVE-2017-11882.R.gen!Camelot
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
Ad-Aware Exploit.RTF-ObfsStrm.Gen
Sophos Troj/RtfExp-EQ
DrWeb Exploit.Rtf.Obfuscated.32
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Exploit-CVE2017-11882.z
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Avira HEUR/Rtf.Malformed
MAX malware (ai score=81)
Antiy-AVL Trojan/Generic.ASDOH.22A
Microsoft Trojan:Script/Wacatac.B!ml
ZoneAlarm HEUR:Exploit.OLE2.Generic
GData Exploit.RTF-ObfsStrm.Gen
Cynet Malicious (score: 99)
AhnLab-V3 RTF/Malform-A.Gen
TACHYON Trojan-Exploit/RTF.CVE-2017-11882
Zoner Probably Heur.RTFBadVersion
Ikarus Exploit.CVE-2017-11882
Fortinet RTF/GenericKD.47107450!tr