8de655e6...32b8

VTI SCORE: 100/100

Dynamic Analysis Report

Classification: Dropper, Downloader

8de655e68ab3408b1101cd0e5f4c3dbe1a361cbb2a5ee10888f5ad30b95332b8 (SHA256)

cm_coupon_6185.doc

Word Document

Created at 2018-11-26 15:52:00

Notifications (1/1)

The operating system was rebooted during the analysis.

Severity	Category	Operation	Classification
5/5	Anti Analysis	Tries to detect virtual machine	-
Possibly trying to detect VM via rdtsc. ... VTI Actions
4/5	Process	Creates process	-
Creates process "C:\Windows\system32\cmd.exe". ... VTI Actions Go to function call
Creates process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe". ... VTI Actions Go to function call
Creates process "C:\Users\aETAdzjz\AppData\Local\Temp\bGD.exe". ... VTI Actions Go to function call
4/5	Network	Downloads data	Downloader
URL "http://greatvacationgiveaways.com/i0Qwfwrn". ... VTI Actions Go to function call
URL "HTTP://79.129.42.122". ... VTI Actions Go to function call
URL "HTTP://50.74.56.147". ... VTI Actions Go to function call
URL "HTTP://75.161.71.124". ... VTI Actions Go to function call
3/5	PE	Executes dropped PE file	-
Executes dropped file "C:\Users\aETAdzjz\AppData\Local\Temp\bGD.exe". ... VTI Actions Go to file details Go to function call
3/5	YARA	YARA match	-
Rule "Document_Contains_Execution_Commands" from ruleset "Malicious-Documents" has matched for "C:\Users\aETAdzjz\Desktop\cm_coupon_6185.doc" ... VTI Actions Go to YARA match
2/5	File System	Known suspicious file	-
File "C:\Users\aETAdzjz\Desktop\cm_coupon_6185.doc" is a known suspicious file. ... VTI Actions Go to file details
2/5	Network	Connects to HTTP server	-
URL "79.129.42.122". ... VTI Actions Go to function call
URL "50.74.56.147". ... VTI Actions Go to function call
URL "75.161.71.124". ... VTI Actions Go to function call
URL "http://greatvacationgiveaways.com/i0Qwfwrn". ... VTI Actions Go to function call
2/5	PE	Drops PE file	Dropper
Drops file "C:\Users\aETAdzjz\AppData\Local\Temp\bGD.exe". ... VTI Actions Go to file details Go to function call
2/5	VBA Macro	Executes macro on specific worksheet event	-
Executes macro automatically on target "auto" and event "open". ... VTI Actions Go to macro
1/5	Process	Creates system object	-
Creates mutex with name "PEMABC". ... VTI Actions Go to function call
Creates mutex with name "PEM89C". ... VTI Actions Go to function call
Creates mutex with name "Global\I705BA84C". ... VTI Actions Go to function call
Creates mutex with name "Global\M705BA84C". ... VTI Actions Go to function call
Creates mutex with name "PEM3A0". ... VTI Actions Go to function call
Creates mutex with name "PEM4D0". ... VTI Actions Go to function call
1/5	Static	Unparsable sections in file	-
Static analyzer was unable to completely parse the analyzed file: C:\Users\aETAdzjz\Desktop\cm_coupon_6185.doc. ... VTI Actions Go to file details
1/5	Static	Contains suspicious meta data	-
Office document contains below average content data. ... VTI Actions Go to file details
1/5	VBA Macro	Contains Office macro	-
Office document contains a VBA macro. ... VTI Actions Go to file details

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Notifications (1/1)

Before

After