popup

Report - doc10773776_660061521

AntiDebug AntiVM MSOffice File
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.03.05 04:14 Machine s1_win7_x6403_us
Filename doc10773776_660061521
Type HTML document, Non-ISO extended-ASCII text, with very long lines, with LF, NEL line terminators
AI Score Not founds Behavior Score
4.2
ZERO API file : clean
VT API (file)
md5 413951d78ff6511e4ebb962c48f852ad
sha256 b12bba44eafea3987fdb4e2c3f9f0f16577005c8c493133aba5c8c8801caeee0
ssdeep 1536:QME3X44BAG/sZzMUCph/OOvWMILq/sthbtKx1iFAlYNvplsY+08otXTsckz3Fywb:Q5B52rKFywBFwkIFT3wU82QDoQ
imphash
impfuzzy
  Network IP location

Signature (10cnts)

Level Description
watch Communicates with host for which no DNS query was performed
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice An application raised an exception which may be indicative of an exploit crash
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Creates executable files on the filesystem
notice Performs some HTTP requests
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info One or more processes crashed

Rules (9cnts)

Level Name Description Collection
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info Microsoft_Office_File_Zero Microsoft Office File binaries (download)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (54cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://vk.com/doc10773776_660061521?hash=zhMo4lmkbD7KIsDYRYkHyGHauSk74UhyRoczpfUZotz&dl=GEYDONZTG43TM:1677236043:ykJwB8SHozZSshsdwaLygwtKhdsQQDTzbewWHuzgaE4&api=1&no_preview=1
whois
RU VKontakte Ltd 93.186.225.194 clean
https://st6-22.vk.com/dist/web/ui_common.84e2442a05004320e11f.js?6245ba39b63448019203f2729b74d21f
whois
RU VKontakte Ltd 95.142.206.2 clean
https://vk.com/dist/web/language.13cbd4193255cbaaab3a.js?c9e9113960ae98d68204079f43f790dd
whois
RU VKontakte Ltd 93.186.225.194 clean
https://st6-22.vk.com/dist/web/polyfills/canvas_to_blob.e77dcc6129127456cc4f.js?6a4a06039f2295cdc4f936f4051ae4d3
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/polyfills/array_functions.5ed53e616feed60bc4e8.js?53b5630d9d361c93a7d8a918fd06d21d
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/react.6d787991b51243317269.js?cb151ae0d77e1fe8ca23
whois
RU VKontakte Ltd 95.142.206.2 clean
https://vk.com/js/lang17_0.js?27965946
whois
RU VKontakte Ltd 93.186.225.194 clean
https://st6-22.vk.com/css/al/uncommon.431a60ba5d2797d2fdb1.css
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/css/al/fonts_cnt.a289ed70815ffbd082ae.css
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/vkcom-kit.a7d2347300fcdde7314f.js?
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/css/al/ui_common.0a29c544720bdcf89154.css
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/polyfills/other_functions.4de689b5f53cdbdebf7d.js?8c0d070969c2bdddf902
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/state-management.a54b236ef99f71c730de.js?503a0b3068ebfc42423d
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/css/al/base.1c25eeb7ac42cd36d08a.css
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/polyfills/string_functions.d2f7aff1dc899fb950c4.js?06c31459c645dd6049c4d07642d01d54
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/common.ca1f22646967566b8a79.js?313ec3f775a31892f568f1d
whois
RU VKontakte Ltd 95.142.206.2 clean
https://vk.com/js/lib/px.js?ch=2
whois
RU VKontakte Ltd 93.186.225.194 clean
https://vk.com/js/lib/px.js?ch=1
whois
RU VKontakte Ltd 93.186.225.194 clean
https://st6-22.vk.com/dist/web/polyfills/resize_observer.233e96db629d43de3623.js?685418a51d9509d705d3
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/unauthorized.b7057b2c97d6727decd8.js?e26656d2ddb168519bdb1f04edf58369
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/polyfills/intersection_observer.0062cad0ff26ba906a55.js?3651dae73da1d676cd37
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/page_layout.5672d3fc73a320a2be06.js?f032491390251591131dd5c0659e5ead
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/css/al/common.a393edc4164b1b81495c.css
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/vkcom-kit.1681489e5ef06505d479.css
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/common_web.3a98749ca45868f84306.css
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/css/al/fonts_utf.2546d253c69649b0561c.css
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/performance_observers.2498c067f2dd4f142b98.js?39ba189ff3c74982dba3105279a1e431
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/polyfills/element_functions.7f6f4401ad09c642705f.js?f88d496bc9aa020bbceb949a351fa85a
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/audioplayer.a025fbbc26f0baaf6890.js?31337e095824bcf8034a4f5
whois
RU VKontakte Ltd 95.142.206.2 clean
https://vk.com/badbrowser_stat.php?act=track&event=showAlert_atom
whois
RU VKontakte Ltd 93.186.225.194 clean
https://st6-22.vk.com/dist/web/polyfills/promise_functions.66c5719129d3a45c5b29.js?c08a609e174e79347eaf8c692cf63cf3
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/docs.6d9ff04ed31e8fa804a8.js?cca036aa8769d40ddfa14e3fbd15949c
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/images/upload.gif
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/polyfills.1881adbf36454e07c9c6.js?a69ef34dc1979f8d5126
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/css_types.9345eb394b7d4d7e68a9.js?f6dbdbc1de537596e14e
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/polyfills/object_functions.06c76fa223949a027bf2.js?e8b681406f943258346d7925b82e6243
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/images/backlink.gif?4
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/common_web.c98533736ab3d5f6f60d.js?
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/palette.28ed80ebcd89c370bca4.js?ceacf32c0417ea87ee9e
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/css/al/vkui.9a6b5aa7dbb00c120b74.css
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/jobs_devtools_notification.eafd4d4aa0ae5bbfd7e6.js?a73adfb8fd6e0413085d78a67df5c20f
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/vkui.e4d670f36de4368e7b1a.js?53396daa49f4462b4a11
whois
RU VKontakte Ltd 95.142.206.2 clean
https://vk.com/js/loader_nav20746467872_17.js
whois
RU VKontakte Ltd 93.186.225.194 clean
https://vk.com/badbrowser_stat.php?act=nomodule
whois
RU VKontakte Ltd 93.186.225.194 clean
https://st6-22.vk.com/dist/web/grip.16ff158c2e1e11fd3b80.js?28c136bb922051f2f6b95a6a08ccc41f
whois
RU VKontakte Ltd 95.142.206.2 clean
https://st6-22.vk.com/dist/web/polyfills/cookie_manager.8cfe6896e33857a19781.js?0afee3c7b5f648f55648a21de4cfaae9
whois
RU VKontakte Ltd 95.142.206.2 clean
https://vk.com/images/icons/favicons/fav_logo.ico?6
whois
RU VKontakte Ltd 93.186.225.194 clean
https://st6-22.vk.com/dist/web/likes.5170c24445a69da4da21.js?ec4d1f4027dfa57b38816d57a184cf8d
whois
RU VKontakte Ltd 95.142.206.2 clean
st6-22.vk.com
whois
RU VKontakte Ltd 95.142.206.2 clean
vk.com
whois
RU VKontakte Ltd 87.240.132.78 clean
login.vk.com
whois
RU VKontakte Ltd 87.240.129.181 clean
93.186.225.194
whois
RU VKontakte Ltd 93.186.225.194 clean
87.240.129.181
whois
RU VKontakte Ltd 87.240.129.181 clean
95.142.206.2
whois
RU VKontakte Ltd 95.142.206.2 clean

Suricata ids

ET INFO Observed URL Shortening Service Domain (vk .com in TLS SNI)
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET INFO URL Shortening Service Domain in DNS Lookup (vk .com)

Similarity measure (PE file only) - Checking for service failure