Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6403_us | July 12, 2023, 7:38 a.m. | July 12, 2023, 7:45 a.m. |
-
WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\mpomzx.doc
1884
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
87.121.221.212 | Active | Moloch |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.103:49163 -> 87.121.221.212:80 | 2016141 | ET INFO Executable Download from dotted-quad Host | Potentially Bad Traffic |
TCP 87.121.221.212:80 -> 192.168.56.103:49163 | 2022050 | ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 | A Network Trojan was detected |
TCP 87.121.221.212:80 -> 192.168.56.103:49163 | 2018959 | ET POLICY PE EXE or DLL Windows file download HTTP | Potential Corporate Privacy Violation |
TCP 87.121.221.212:80 -> 192.168.56.103:49163 | 2022051 | ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 | A Network Trojan was detected |
TCP 87.121.221.212:80 -> 192.168.56.103:49163 | 2021076 | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
suspicious_features | Connection to IP address | suspicious_request | GET http://87.121.221.212/mpomzx.exe |
request | GET http://87.121.221.212/mpomzx.exe |
file | C:\Users\test22\AppData\Local\Temp\~$mpomzx.doc |
filetype_details | Rich Text Format data, version 1, unknown character set | filename | mpomzx.doc |
host | 87.121.221.212 |
Lionic | Trojan.MSOffice.CVE-2018-0802.4!c |
MicroWorld-eScan | Trojan.GenericKDZ.93390 |
FireEye | Trojan.GenericKDZ.93390 |
CAT-QuickHeal | Exp.RTF.Obfus.Gen |
McAfee | RTFObfustream.c!45BC6B0241B3 |
Sangfor | Malware.Generic-RTF.Save.47fbdc1d |
Arcabit | Trojan.Generic.D16CCE |
Cyren | RTF/CVE-2017-11882.U.gen!Camelot |
Symantec | Exp.CVE-2017-11882!g6 |
Avast | Other:Malware-gen [Trj] |
Cynet | Malicious (score: 99) |
Kaspersky | HEUR:Exploit.MSOffice.CVE-2018-0802.gen |
BitDefender | Trojan.GenericKDZ.93390 |
NANO-Antivirus | Exploit.Rtf.Heuristic-rtf.dinbqn |
Tencent | Office.Exploit.Cve-2018-0802.Twhl |
Emsisoft | Trojan.GenericKDZ.93390 (B) |
F-Secure | Exploit.EXP/YAV.Minerva.buvly |
DrWeb | Exploit.CVE-2018-0798.4 |
VIPRE | Trojan.GenericKDZ.93390 |
TrendMicro | HEUR_RTFMALFORM |
McAfee-GW-Edition | BehavesLike.Trojan.pv |
Sophos | Troj/RTFDl-CJA |
Avira | EXP/YAV.Minerva.buvly |
MAX | malware (ai score=86) |
Gridinsoft | Trojan.U.AgentTesla.bot |
Microsoft | Exploit:O97M/CVE-2017-11882.RVR |
ZoneAlarm | HEUR:Exploit.MSOffice.CVE-2018-0802.gen |
GData | Trojan.GenericKDZ.93390 |
Detected | |
AhnLab-V3 | RTF/Malform-D.Gen |
ALYac | Trojan.GenericKDZ.93390 |
Zoner | Probably Heur.RTFObfuscation |
Yandex | Trojan.AvsRicher.bZAyIk |
Ikarus | Win32.Outbreak |
Fortinet | MSOffice/CVE_2018_0798.BOR!exploit |
AVG | Other:Malware-gen [Trj] |