Edit tour
Windows
Analysis Report
DanielEmployee-Handbook-84408.doc
Overview
General Information
| Sample name: | DanielEmployee-Handbook-84408.doc |
| Analysis ID: | 1648840 |
| MD5: | 38df9ff0fcbd2e8312b9f33cfb7978b7 |
| SHA1: | 3a6a98181d6eb63f67a10a746f5b490633eebc9f |
| SHA256: | ce09989dc9e230fc9c09a072cb940c1c9c3a79bf4afc6acb3b9ada8a9d11b2f7 |
| Infos: | |
 | |
Detection
Gabagool
| Score: | 64 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Yara detected Gabagool
AI detected landing page (webpage, office document or email)
AI detected suspicious Javascript
HTML page contains hidden URLs
HTML page contains suspicious javascript code
Creates files inside the system directory
Deletes files inside the Windows folder
HTML body contains low number of good links
HTML body contains password input but no form action
HTML body with high number of embedded images detected
HTML page contains hidden javascript code
HTML title does not match URL
Javascript checks online IP of machine
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)
Classification
- System is w10x64_ra
WINWORD.EXE (PID: 6980 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\WINWO RD.EXE" /n "C:\Users \user\Desk top\Daniel Employee-H andbook-84 408.doc" / o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)
chrome.exe (PID: 6232 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --s tart-maxim ized --sin gle-argume nt https:/ /daniel.ab ovetheaeth er.com/gNG IAEMgkIAhA AGA0YgAQyC ggDEAAYCBg NGB4yCggEE AAYCBgNGB4 yCggFEAAYC BgNGB4yCgg GEAAYCBgNG B4yCgg/dy7 iZ8OaB7nkw N4Pv5njsA4 #MZGFuaWVs Lmhpbm5pQH NlbHV0aW9u LmNo MD5: E81F54E6C1129887AEA47E7D092680BF) - chrome.exe (PID: 2908 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --no-pre-r ead-main-d ll --field -trial-han dle=1852,i ,156777671 0311643867 5,16553663 6293968929 10,262144 --disable- features=O ptimizatio nGuideMode lDownloadi ng,Optimiz ationHints ,Optimizat ionHintsFe tching,Opt imizationT argetPredi ction --va riations-s eed-versio n --mojo-p latform-ch annel-hand le=2208 /p refetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
- cleanup
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Gabagool | Yara detected Gabagool | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
- • Phishing
- • Compliance
- • Software Vulnerabilities
- • Networking
- • System Summary
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Language, Device and Operating System Detection
Click to jump to signature section
Show All Signature Results
Phishing |   |
|---|
| Source: | File source: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Memory has grown: | ||
| Source: | Memory has grown: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | File created: | ||
| Source: | File deleted: | ||
| Source: | Classification label: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | OLE indicator, Word Document stream: | ||
| Source: | OLE document summary: | ||
| Source: | OLE document summary: | ||
| Source: | OLE document summary: | ||
| Source: | File read: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Key value queried: | ||
| Source: | Window detected: | ||
| Source: | Key opened: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Initial sample: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information queried: | ||
| Source: | Key value queried: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | 1 Scripting | Valid Accounts | Windows Management Instrumentation | 2 Browser Extensions | 1 Process Injection | 11 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 Scripting | 1 Extra Window Memory Injection | 1 Process Injection | LSASS Memory | 1 File and Directory Discovery | Remote Desktop Protocol | Data from Removable Media | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Deobfuscate/Decode Files or Information | Security Account Manager | 2 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 4 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 File Deletion | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | 5 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Extra Window Memory Injection | LSA Secrets | Internet Connection Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| daniel.abovetheaether.com | 192.227.220.12 | true | true | unknown | |
| ipapi.co | 104.26.8.44 | true | false | high | |
| a.nel.cloudflare.com | 35.190.80.1 | true | false | high | |
| e329293.dscd.akamaiedge.net | 23.209.72.31 | true | false | high | |
| code.jquery.com | 151.101.194.137 | true | false | high | |
| cdnjs.cloudflare.com | 104.17.24.14 | true | false | high | |
| challenges.cloudflare.com | 104.18.94.41 | true | false | high | |
| www.google.com | 142.251.40.196 | true | false | high | |
| s-0005.dual-s-msedge.net | 52.123.129.14 | true | false | high | |
| one.alketbilabs.ai | 104.26.0.170 | true | true | unknown | |
| aadcdn.msauthimages.net | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false |
| unknown | |
| false | high | ||
| false | high | ||
| false |
| unknown | |
| false |
| unknown | |
| false | high | ||
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false | high | ||
| false |
| unknown | |
| false |
| unknown | |
| true | unknown | ||
| true |
| unknown | |
| false |
| unknown | |
| true |
| unknown | |
| false |
| unknown | |
| false | high | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 104.26.8.44 | ipapi.co | United States | 13335 | CLOUDFLARENETUS | false | |
| 23.204.23.20 | unknown | United States | 16625 | AKAMAI-ASUS | false | |
| 142.250.80.110 | unknown | United States | 15169 | GOOGLEUS | false | |
| 104.18.94.41 | challenges.cloudflare.com | United States | 13335 | CLOUDFLARENETUS | false | |
| 142.251.40.227 | unknown | United States | 15169 | GOOGLEUS | false | |
| 142.251.32.99 | unknown | United States | 15169 | GOOGLEUS | false | |
| 52.123.129.14 | s-0005.dual-s-msedge.net | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 20.189.173.17 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 192.227.220.12 | daniel.abovetheaether.com | United States | 36352 | AS-COLOCROSSINGUS | true | |
| 142.251.40.196 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 151.101.194.137 | code.jquery.com | United States | 54113 | FASTLYUS | false | |
| 35.190.80.1 | a.nel.cloudflare.com | United States | 15169 | GOOGLEUS | false | |
| 23.209.72.31 | e329293.dscd.akamaiedge.net | United States | 20940 | AKAMAI-ASN1EU | false | |
| 52.109.20.38 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 104.17.24.14 | cdnjs.cloudflare.com | United States | 13335 | CLOUDFLARENETUS | false | |
| 1.1.1.1 | unknown | Australia | 13335 | CLOUDFLARENETUS | false | |
| 104.26.0.170 | one.alketbilabs.ai | United States | 13335 | CLOUDFLARENETUS | true | |
| 23.216.132.53 | unknown | United States | 7016 | CCCH-3US | false | |
| 172.67.68.147 | unknown | United States | 13335 | CLOUDFLARENETUS | false | |
| 52.111.251.17 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 104.18.95.41 | unknown | United States | 13335 | CLOUDFLARENETUS | false | |
| 142.250.65.206 | unknown | United States | 15169 | GOOGLEUS | false | |
| 142.251.40.163 | unknown | United States | 15169 | GOOGLEUS | false | |
| 142.251.163.84 | unknown | United States | 15169 | GOOGLEUS | false |
| IP |
|---|
| 192.168.2.16 |
| 192.168.2.23 |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1648840 |
| Start date and time: | 2025-03-26 08:56:27 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsinteractivecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 17 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | stream |
| Analysis stop reason: | Timeout |
| Sample name: | DanielEmployee-Handbook-84408.doc |
| Detection: | MAL |
| Classification: | mal64.phis.winDOC@23/12@28/196 |
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): svchost.exe - Excluded IPs from analysis (wh
itelisted): 52.109.20.38, 23.2 04.23.20, 52.111.251.17, 52.11 1.251.19, 52.111.251.16, 52.11 1.251.18, 52.123.129.14, 20.19 0.152.21 - Excluded domains from analysis
(whitelisted): ecs.office.com , fs.microsoft.com, prod.confi gsvc1.live.com.akadns.net, scu s-azsc-config.officeapps.live. com, prod-na.naturallanguageed itorservice.osi.office.net.aka dns.net, fs-wildcard.microsoft .com.edgekey.net, fs-wildcard. microsoft.com.edgekey.net.glob alredir.akadns.net, e16604.dsc f.akamaiedge.net, prod-canc-re solver.naturallanguageeditorse rvice.osi.office.net.akadns.ne t, prod1.naturallanguageeditor service.osi.office.net.akadns. net, dual-s-0005-office.config .skype.com, nleditor.osi.offic e.net, login.live.com, config. officeapps.live.com, us.config svc1.live.com.akadns.net, offi ceclient.microsoft.com, ecs.of fice.trafficmanager.net, prod. fs.microsoft.com.akadns.net - Not all processes where analyz
ed, report is missing behavior information - Report size getting too big, t
oo many NtQueryAttributesFile calls found. - Report size getting too big, t
oo many NtQueryValueKey calls found. - Report size getting too big, t
oo many NtReadVirtualMemory ca lls found. - Some HTTPS proxied raw data pa
ckets have been limited to 10 per session. Please view the P CAPs for the complete data. - VT rate limit hit for: daniel
.abovetheaether.com
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 512 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | BF619EAC0CDF3F68D496EA9344137E8B |
| SHA1: | 5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5 |
| SHA-256: | 076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 |
| SHA-512: | DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 162 |
| Entropy (8bit): | 2.5726726094536483 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 1134C7BF8DA025A2589B4BE9D867449B |
| SHA1: | F3318281E4A150F1E2E53B6B147F2BA6FA1C02DA |
| SHA-256: | 29B4EC383B129F47A0CC64E0E2A42E2694AFC88651DCEF719D379DC58ED9D1EC |
| SHA-512: | 98473CADDFBF82386FFBF5FA8B891BCA0CB5D9041E1C4B9D58CA869E537FE08E403542E1FECE58344135BE43E86CB4129B5361E3D6CC474C2426A41701748785 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 89501 |
| Entropy (8bit): | 5.289893677458563 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 8FB8FEE4FCC3CC86FF6C724154C49C42 |
| SHA1: | B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4 |
| SHA-256: | FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E |
| SHA-512: | F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://code.jquery.com/jquery-3.6.0.min.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 61 |
| Entropy (8bit): | 4.068159130770306 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 1253F72A1ED35E642EEB30DEC52CCEDD |
| SHA1: | 9F5DC4347E76E55FADA9897F17BEE89663E012A8 |
| SHA-256: | 7201D968F30B5D1B69C0AEFFB40CBADF1192E0FF6ED9AA4C6D9F1AA10A381EC2 |
| SHA-512: | F7D9F24652C5D7AFC4909A50B9B232CC475BFD7775C7E33483F63B5AECCABDBC3ACF0B6CC99AA4B849043BFD64520FC7FE82EC5432362F2F21846F12851B5533 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/926519525f71438a/1742975865943/PfhuddysdPN7kjP |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 772 |
| Entropy (8bit): | 4.768305351375119 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 35B55021B21E95AB37525855A0A3C9E3 |
| SHA1: | 64BD159F18C94EA130019C306693D1108E011FBF |
| SHA-256: | 975388D22FB5E84E383A0B6E1AEBD9256D934315C61D961D386909AD77935EBE |
| SHA-512: | 7EB2E322D93C22F23C99C943A72FEB472EED53F79B4521EB68A261DD2910B595ADD968CA789EC117BD3BAED5DB2F7E86A7366ADB6831454AF9E5838813F2D181 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 47992 |
| Entropy (8bit): | 5.605846858683577 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | CF3402D7483B127DED4069D651EA4A22 |
| SHA1: | BDE186152457CACF9C35477B5BDDA5BCB56B1F45 |
| SHA-256: | EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC |
| SHA-512: | 9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 61 |
| Entropy (8bit): | 3.990210155325004 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9246CCA8FC3C00F50035F28E9F6B7F7D |
| SHA1: | 3AA538440F70873B574F40CD793060F53EC17A5D |
| SHA-256: | C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84 |
| SHA-512: | A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 58296 |
| Entropy (8bit): | 6.052265860508475 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | CBB42513032D6C09E496731AC16C20A9 |
| SHA1: | C92F38A701AAD58408451D24DD4C47B05F158CF0 |
| SHA-256: | D189695B2F3BB92369881F2428FA861DCA9D9A94C638D9BDC4E2FA747D6F315B |
| SHA-512: | 3D76F1018AFCEABA7CBB4083F4A5B5758966EC2AA5D5C6B07D72361782809F7ED4BD34ED9E0C4154D01A2DB7192155DE8251E5A834DD90B8D9823D916E1B7285 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://daniel.abovetheaether.com/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 40 |
| Entropy (8bit): | 4.120950594454667 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | B09F000BFB98ABD880BC77E05456FFEA |
| SHA1: | FBADFA7F41B709507692B8FCEA597474EED91E2C |
| SHA-256: | 0A721532497036FF7D8B228DD8D4EF5E91777B0BD2B11F49F5B2CCDDD55EB259 |
| SHA-512: | F2E0CF9FD6D14EAF9BE953052515A598E9F96186FB82D5FA8D3E9B01F9706284DE8DDDF343AB69CF566EDEB28C659D65E0D608F99A5717A7CBFB2CC48ADA15A7 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 295316 |
| Entropy (8bit): | 7.920261603808197 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 27BEB1F15D918943C685AF9DF98DB3E6 |
| SHA1: | 00771E6D0370A101BE0037FAAD66CB21A47B2F01 |
| SHA-256: | 9299CD0C2E68B1531C8A2CD00B7ECDF49E358E4009796BFC04BDB1E95A1AAA35 |
| SHA-512: | A66118EBE8C0A9B2514B0249231C54F1B1AE69FB763C11DB8925C84625946256F6AC9CA97140C7EDBD276F063644758931A8EF7EF59BA936EB93A997D2ED3137 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 48123 |
| Entropy (8bit): | 5.342998089666478 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | EA38BDA3C117E2FE01BD862003357394 |
| SHA1: | 767CCB3589E3067EE1B348DF2426A9E2E32CEE5C |
| SHA-256: | 719423C7B70AC911F76D00B3AE514D108A8315EA60A80519820BE50C0E4C96EF |
| SHA-512: | F50FAB9DC2263F40216DF26C234AD390091F23185650E9B4E4748CF09CFEDF2D92A99FC81C986234580844393305AC2195E096DEDB64D9A25A99EF7BE510FFCA |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://challenges.cloudflare.com/turnstile/v0/b/708f7a809116/api.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 48316 |
| Entropy (8bit): | 5.6346993394709 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 2CA03AD87885AB983541092B87ADB299 |
| SHA1: | 1A17F60BF776A8C468A185C1E8E985C41A50DC27 |
| SHA-256: | 8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762 |
| SHA-512: | 13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.722998073766099 |
| TrID: |
|
| File name: | DanielEmployee-Handbook-84408.doc |
| File size: | 73'728 bytes |
| MD5: | 38df9ff0fcbd2e8312b9f33cfb7978b7 |
| SHA1: | 3a6a98181d6eb63f67a10a746f5b490633eebc9f |
| SHA256: | ce09989dc9e230fc9c09a072cb940c1c9c3a79bf4afc6acb3b9ada8a9d11b2f7 |
| SHA512: | b8fb53d6f2fd06f9d2d98fe844c65848425bd4830be2d52d1bde9730a3d4eee3b497eb2c7e3d14d639871326de79bebffeb8c04bab9e997823e1f5634c85d895 |
| SSDEEP: | 768:4V8hkFm/a5BpgYGDhiNsSk+RqQnOdAW9OVSJDYEQ+qSR10zktfe4gEA55BLAiVHv:Y8qFm/OADsFJWl9YQA45FePEA5/Px |
| TLSH: | B7736C8313D3A605F177E9B28677C2B47A317C684D779A2A16507E1EECB2A240F74B13 |
| File Content Preview: | ........................!...................................................................................................................................................................................................................................... |
 | |
| Icon Hash: | 35e1cc889a8a8599 |
| Document Type: | OLE |
| Number of OLE Files: | 1 |
| Has Summary Info: | |
| Application Name: | None |
| Encrypted Document: | False |
| Contains Word Document Stream: | True |
| Contains Workbook/Book Stream: | False |
| Contains PowerPoint Document Stream: | False |
| Contains Visio Document Stream: | False |
| Contains ObjectPool Stream: | False |
| Flash Objects Count: | 0 |
| Contains VBA Macros: | False |
| Code Page: | 1200 |
| Title: | |
| Subject: | |
| Author: | |
| Keywords: | |
| Last Saved By: | |
| Revion Number: | 0 |
| Total Edit Time: | 0 |
| Last Printed: | 1601-01-01 00:00:00 |
| Create Time: | 1601-01-01 00:00:00 |
| Last Saved Time: | 1601-01-01 00:00:00 |
| Number of Words: | 0 |
| Number of Characters: | 0 |
| Security: | 0 |
| Document Code Page: | 1200 |
| Number of Paragraphs: | 0 |
| Thumbnail Scaling Desired: | False |
General | |
| Stream Path: | \x5DocumentSummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 104 |
| Entropy: | 2.479305463121663 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . 8 . . . . . . . . . . . . . . . . . . ( . . . . . . . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 05 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 38 00 00 00 03 00 00 00 01 00 00 00 20 00 00 00 0b 00 00 00 28 00 00 00 06 00 00 00 30 00 00 00 02 00 00 00 b0 04 00 00 0b 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 |
General | |
| Stream Path: | \x5SummaryInformation |
| CLSID: | |
| File Type: | data |
| Stream Size: | 320 |
| Entropy: | 2.0282772532194504 |
| Base64 Encoded: | False |
| Data ASCII: | . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . |
| Data Raw: | fe ff 00 00 05 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 10 01 00 00 0e 00 00 00 01 00 00 00 78 00 00 00 04 00 00 00 80 00 00 00 10 00 00 00 8c 00 00 00 0c 00 00 00 94 00 00 00 05 00 00 00 a0 00 00 00 0b 00 00 00 ac 00 00 00 08 00 00 00 b8 00 00 00 0d 00 00 00 c4 00 00 00 09 00 00 00 d0 00 00 00 |
General | |
| Stream Path: | 1Table |
| CLSID: | |
| File Type: | data |
| Stream Size: | 5159 |
| Entropy: | 3.4474333568025113 |
| Base64 Encoded: | False |
| Data ASCII: | Z . % . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . |
| Data Raw: | 5a 04 25 00 12 00 01 00 0b 01 0f 00 00 00 03 00 03 00 03 00 03 00 04 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 |
General | |
| Stream Path: | Data |
| CLSID: | |
| File Type: | data |
| Stream Size: | 44460 |
| Entropy: | 7.890653653613907 |
| Base64 Encoded: | True |
| Data ASCII: | 3 . . . D . d . . . . . . . . . . . . . . . . . . . . . @ . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . J . . . . . . . . . . . . . . . . . 3 . . . . . . . . . . . A . . . . . . . . . # . " . . . . . . . . . . . . . . . . . . . . . . . . R . . . . . . . . [ @ $ F . . s . g . q . . . . . . . D . . . . . . . F . i . . . . [ @ $ F . . s . g . . J F I F . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . % . . . " 1 ! % ) + . |
| Data Raw: | 33 1b 00 00 44 00 64 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0b 40 0b e8 03 e8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 04 f0 4a 00 00 00 b2 04 0a f0 08 00 00 00 01 04 00 00 00 0a 00 00 33 00 0b f0 12 00 00 00 7f 00 80 00 80 00 04 41 01 00 00 00 bf 01 02 00 02 00 23 00 22 f1 0c 00 00 00 90 03 |
General | |
| Stream Path: | WordDocument |
| CLSID: | |
| File Type: | data |
| Stream Size: | 19968 |
| Entropy: | 4.015790294021357 |
| Base64 Encoded: | False |
| Data ASCII: | . ! ` . . . . . . . . . . . . . . . . . . . . . . . . . A W N . 2 4 . 8 . . . . . . . . . . . . . . . . . . . . . . . N . . > . . > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . . . @ . . . t . . . . . . . . . . . . . > . . . . . . . |
| Data Raw: | ec a5 c1 00 21 60 09 04 00 00 f8 12 bf 00 00 00 00 00 00 10 00 00 00 00 00 08 00 00 94 1b 00 00 0e 00 41 57 4e 00 32 34 2e 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 04 16 00 00 4e 00 00 3e c7 00 00 3e c7 00 00 ca 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node