Windows Analysis Report
Offer 15492024 15602024.docx.doc

Overview

General Information

Sample name: Offer 15492024 15602024.docx.doc
Analysis ID: 1446728
MD5: 0d0f500d82551e733eab0fb1060a49da
SHA1: 1e9af5dd484358b007673b0d7f9b85f8ac1a7b6c
SHA256: d5e214f3096564dfc3e348b6a3ac6aeefed75d785ac7cfab5d3019f67fdbc9be
Tags: docdocx
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for submitted file
Contains an external reference to another file
Document exploit detected (process start blacklist hit)
Office viewer loads remote template
Document misses a certain OLE stream usually present in this Microsoft Office document type
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: Suspicious Office Outbound Connections
Uses a known web browser user agent for HTTP communication
Uses insecure TLS / SSL version for HTTPS connection

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Offer 15492024 15602024.docx.doc ReversingLabs: Detection: 13%
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 172.67.171.37:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown HTTPS traffic detected: 104.21.47.128:443 -> 192.168.2.22:49169 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 104.21.47.128:443 -> 192.168.2.22:49170 version: TLS 1.2
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Directory queried: number of queries: 1006

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: bot.ax
Source: global traffic DNS query: name: bot.ax
Source: global traffic DNS query: name: bot.ax
Source: global traffic DNS query: name: bot.ax
Source: global traffic DNS query: name: bot.ax
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 172.67.171.37:80
Source: global traffic TCP traffic: 172.67.171.37:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 172.67.171.37:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 172.67.171.37:80
Source: global traffic TCP traffic: 172.67.171.37:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 172.67.171.37:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 172.67.171.37:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 172.67.171.37:80
Source: global traffic TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.47.128:80
Source: global traffic TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.47.128:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.47.128:80
Source: global traffic TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.47.128:80
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 172.67.171.37:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.21.47.128:80
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 172.67.171.37 172.67.171.37
Source: Joe Sandbox View IP Address: 104.21.47.128 104.21.47.128
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /hNZdz HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: bot.axConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /hNZdz HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: bot.axConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 172.67.171.37:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown HTTPS traffic detected: 104.21.47.128:443 -> 192.168.2.22:49169 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E279F50C-91EA-4841-A527-8D9534FAEB24}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /hNZdz HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: bot.axConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /hNZdz HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: bot.axConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: bot.ax
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 18:41:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeset-cookie: PHPSESSID=ccqb5jblbbpgelnc46rrjjjacs; path=/expires: Thu, 19 Nov 1981 08:52:00 GMTcache-control: no-store, no-cache, must-revalidatepragma: no-cacheCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eWn4AR2JlvSGXIYHhmmkBq4m0b9AN9ruCiuFGW5GrXSo3pf1ytUz5%2F4dXhkqFI2X91%2BaP9fqqSKY%2FAKuo%2FSYodhTojFaZC77pauiNowuecahNqhZ1ofoZWo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88872db6a9cd0f6b-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 18:41:17 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeset-cookie: PHPSESSID=8pqa1qkp3733as8k1h92tuc7et; path=/expires: Thu, 19 Nov 1981 08:52:00 GMTcache-control: no-store, no-cache, must-revalidatepragma: no-cachevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zg3sDoZsaDlJ2YKgBtWaci3lH8cInlpxk2SYPdK6Pw2WOmshxm%2BqnEe4zHlQKB1chA1TOG7T4qp7l5mPW3u59W1eb4lj4OQHiv%2BtcaMYWFSUprWjrvffodk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88872dded9010dc7-EWRalt-svc: h3=":443"; ma=86400
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown HTTPS traffic detected: 104.21.47.128:443 -> 192.168.2.22:49170 version: TLS 1.2
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: classification engine Classification label: mal68.expl.evad.winDOC@18/29@5/3
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$fer 15492024 15602024.docx.doc Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR6BDC.tmp Jump to behavior
Source: Offer 15492024 15602024.docx.doc OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc OLE document summary: title field not present or empty
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr OLE document summary: title field not present or empty
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr OLE document summary: author field not present or empty
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr OLE document summary: edited time not present or 0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: Offer 15492024 15602024.docx.doc ReversingLabs: Detection: 13%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: Offer 15492024 15602024.docx.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\Offer 15492024 15602024.docx.doc
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Offer 15492024 15602024.docx.doc Initial sample: OLE zip file path = word/embeddings/oleObject7.bin
Source: Offer 15492024 15602024.docx.doc Initial sample: OLE zip file path = word/embeddings/oleObject6.bin
Source: Offer 15492024 15602024.docx.doc Initial sample: OLE zip file path = word/embeddings/oleObject5.bin
Source: Offer 15492024 15602024.docx.doc Initial sample: OLE zip file path = word/embeddings/oleObject2.bin
Source: Offer 15492024 15602024.docx.doc Initial sample: OLE zip file path = word/media/image2.emf
Source: Offer 15492024 15602024.docx.doc Initial sample: OLE zip file path = word/embeddings/oleObject4.bin
Source: Offer 15492024 15602024.docx.doc Initial sample: OLE zip file path = word/embeddings/oleObject3.bin
Source: Offer 15492024 15602024.docx.doc Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Offer 15492024 15602024.docx.doc Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior
barindex
Microsoft Office launches external ms-search protocol handler (WebDAV)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: \Device\RdpDr\;:1\bot.ax\DavWWWRoot Jump to behavior
Contains an external reference to another file
Source: settings.xml.rels Extracted files from sample: http://bot.ax/hnzdz
Office viewer loads remote template
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Section loaded: netapi32.dll and davhlpr.dll loaded Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: Offer 15492024 15602024.docx.doc Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc Stream path 'CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr Stream path '_1777980428/CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr Stream path '_1777980429/CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr Stream path '_1777980430/CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr Stream path '_1777980431/CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr Stream path '_1777980433/CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr Stream path '_1777980434/CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr Stream path '_1777980435/CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr Stream path '_1777980436/CONTENTS' entropy: 7.91598386737 (max. 8.0)
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Directory queried: number of queries: 1006
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1446728 Sample: Offer 15492024 15602024.docx.doc Startdate: 23/05/2024 Architecture: WINDOWS Score: 68 17 bot.ax 2->17 25 Multi AV Scanner detection for submitted file 2->25 27 Contains an external reference to another file 2->27 29 Document exploit detected (process start blacklist hit) 2->29 8 WINWORD.EXE 305 61 2->8         started        signatures3 process4 dnsIp5 19 bot.ax 104.21.47.128, 443, 49165, 49168 CLOUDFLARENETUS United States 8->19 21 172.67.171.37, 443, 49166, 49167 CLOUDFLARENETUS United States 8->21 31 Microsoft Office launches external ms-search protocol handler (WebDAV) 8->31 33 Office viewer loads remote template 8->33 12 AcroRd32.exe 30 8->12         started        signatures6 process7 process8 14 RdrCEF.exe 2 12->14         started        dnsIp9 23 192.168.2.255, 137, 138 unknown unknown 14->23
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.67.171.37
 unknown United States
13335 CLOUDFLARENETUS false
104.21.47.128
 bot.ax United States
13335 CLOUDFLARENETUS true

Private

IP
192.168.2.255

Contacted Domains

Name IP Active
bot.ax 104.21.47.128 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://bot.ax/hNZdz false
  • Avira URL Cloud: safe
 unknown
http://bot.ax/hNZdz false
  • Avira URL Cloud: safe
 unknown