Report - a268e9e152c260a0e80431aa8d6df187d9f24a1b6be71328ea14320436083f51.doc

ScreenShot

Info
Location map


Created	2021.04.18 10:36	Machine	s1_win7_x6401
Filename	a268e9e152c260a0e80431aa8d6df187d9f24a1b6be71328ea14320436083f51.doc
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Subje
AI Score	Not founds	Behavior Score	4.8
ZERO API	file : clean
VT API (file)	50 detected (malicious, high confidence, Valyria, Save, EMOTET, SMJB1, EmotetRed1220, ijcgra, SAgent, ObfusVBA@ML, ABVG, Malware@#3ijl0yjz6x7pg, W2000M, Static AI, Malicious OLE, ai score=99, score, Probably Heur, W97Obfuscated, qexvmc)
md5	a58394937da9d3adb33e948058fde4e9
sha256	a268e9e152c260a0e80431aa8d6df187d9f24a1b6be71328ea14320436083f51
ssdeep	3072:2ISPO2TNqU+PRGfFz9ufstRUUKSns8T00JSHUgteMJ8qMD7gAUh:Ct+P6z9ufsfgIf0pLAC
imphash
impfuzzy

Network IP location

Signature (8cnts)

Level	Description
danger	File has been identified by 50 AntiVirus engines on VirusTotal as malicious
danger	Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually)
watch	Libraries known to be associated with a CVE were requested (may be False Positive)
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Creates (office) documents on the filesystem
notice	Creates hidden or system file
notice	HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice	Performs some HTTP requests

Rules (2cnts)

Level	Name	Description	Collection
warning	Contains_VBA_macro_code	Detect a MS Office document with embedded VBA macro code [binaries]	binaries (upload)
info	Microsoft_Office_Document_Zero	Microsoft Office Document Signature Zero	binaries (upload)

Network (19cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
http://rsimadinah.com/wp-content/16qT/ whois		PT. Eka Mas Republik	66.96.230.225		malware
http://insvat.com/wp-admin/Dw/ whois		10dencehispahard, S.L.	185.42.104.77		malware
http://blogs.g2gtechnologies.com/blogs/v/ whois		PUBLIC-DOMAIN-REGISTRY	208.91.199.15		malware
http://pattayastore.com/visio-network-1hmpp/j5/ whois		CS LOXINFO Public Company Limited.	202.183.165.89		malware
https://tenmoney.business/wp-content/nhW/ whois		CLOUDFLARENET	172.67.156.186		mailcious
blogs.g2gtechnologies.com whois		PUBLIC-DOMAIN-REGISTRY	208.91.199.15		malware
sureoptimize.com whois		DIGITALOCEAN-ASN	142.93.247.242		malware
tenmoney.business whois		CLOUDFLARENET	104.21.8.30		mailcious
pattayastore.com whois		CS LOXINFO Public Company Limited.	202.183.165.89		malware
rsimadinah.com whois		PT. Eka Mas Republik	66.96.230.225		malware
insvat.com whois		10dencehispahard, S.L.	185.42.104.77		malware
littleindiadirectory.com whois		AMAZON-02	18.141.196.101		malware
185.42.104.77 whois		10dencehispahard, S.L.	185.42.104.77		malware
208.91.199.15 whois		PUBLIC-DOMAIN-REGISTRY	208.91.199.15		malware
202.183.165.89 whois		CS LOXINFO Public Company Limited.	202.183.165.89		clean
142.93.247.242 whois		DIGITALOCEAN-ASN	142.93.247.242		clean
66.96.230.225 whois		PT. Eka Mas Republik	66.96.230.225		malware
172.67.156.186 whois		CLOUDFLARENET	172.67.156.186		mailcious
18.141.196.101 whois		AMAZON-02	18.141.196.101		malware

Suricata ids

Similarity measure (PE file only) - Checking for service failure