Malicious
Classifications
-
Threat Names
Mal/Generic-S
Dynamic Analysis Report
Created on 2024-08-01T15:33:05+00:00
test-2.doc
Word Document
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
File Name | Category | Type | Verdict | Actions |
---|
C:\Users\RDhJ0CNFevzX\Desktop\test-2.doc | Sample File | Word Document |
Malicious
|
...
|
»
File Reputation Information
»
Verdict |
Malicious
|
Names | Mal/Generic-S |
Office Information
»
Creator | Учетная запись Майкрософт |
Last Modified By | administrator |
Revision | 15 |
Create Time | 2020-07-24 16:18 (UTC+2) |
Modify Time | 2024-08-01 15:51 (UTC+2) |
Application | Microsoft Office Word |
App Version | 16.0000 |
Template | Normal |
Company | Home PC |
Document Security | NONE |
Editing Time | 4.0 |
Page Count | 6 |
Line Count | 56 |
Paragraph Count | 37 |
Word Count | 11884 |
Character Count | 6775 |
Chars With Spaces | 18622 |
ScaleCrop | False |
SharedDoc | False |
language | ru-RU |
VBA Macros (1)
»
Macro #1: NewMacros
»
Document Content Snippet
»
Test 31.08.2021 Test 17.08.2021Test-1 24.03.2021Test 17.03.2021Test 16.02.2021Test 11.02.2021test 04-03-2022 doctest 2022-09-02test 2023-08-24test 2023-08-30test 2024-08-01 testDATAVhoxjtytrn&H4D&H5A&H90&H00&H03&H00&H00&H00&H04&H00&H00&H00&HFF&HFF&H00&H00&HB8&H00&H00&H00&H00&H00&H00&H00&H40&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H00&H80&H00&H00&H00&H0E&H1F&HBA&H0E&H00&HB4&H09&HCD&H21&HB8&H01&H4C&HCD&H21&H54&H68&H69&H73&H20&H70&H72&H6F&H67&H72&H61&H6D&H20&H63&H61&H6E&H6E&H6F&H74&H20&H62&H65&H20&H72&H75&H6E&H20&H69&H6E&H20&H44&H4F&H53&H20&H6D&H6F&H64&H65&H2E&H0D&H0D&H0A&H24&H00&H00&H00&H00&H00&H00&H00&H50&H45&H00&H00&H4C&H01&H03&H00&HE8&HDD&H41&H9F&H00&H00&H00&H00&H00&H00&H00&H00&HE0&H00&H0F&H03&H0B&H01&H02&H38&H00&H02&H00&H00&H00&H0E&H00&H00&H00&H00&H00&H00&H00&H10&H00&H00&H00&H10&H00&H00&H00&H20&H00&H00&H00&H00&H40&H00&H00&H10&H00&H00&H00&H02&H00&H00&H04&H00&H00&H00&H01&H00&H00&H00&H04&H00& |
C:\Users\RDhJ0CNFevzX\sowAvpiYaacf.exe | Dropped File | Binary |
Malicious
|
...
|
»
File Reputation Information
»
Verdict |
Malicious
|
PE Information
»
Image Base | 0x00400000 |
Entry Point | 0x00401000 |
Size Of Code | 0x00000200 |
Size Of Initialized Data | 0x00000E00 |
File Type | IMAGE_FILE_EXECUTABLE_IMAGE |
Subsystem | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Machine Type | IMAGE_FILE_MACHINE_I386 |
Compile Timestamp | 2054-09-01 18:46 (UTC+2) |
Sections (3)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x00401000 | 0x00000028 | 0x00000200 | 0x00000200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 0.35 |
.data | 0x00402000 | 0x00000A90 | 0x00000C00 | 0x00000400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.49 |
.idata | 0x00403000 | 0x00000064 | 0x00000200 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.66 |
Imports (1)
»
KERNEL32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ExitProcess | - | 0x00403038 | 0x0000302C | 0x0000102C | 0x0000009C |
Memory Dumps (4)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|
sowavpiyaacf.exe | 2 | 0x00400000 | 0x00403FFF | First Execution |
![]() |
32-bit | 0x00401000 |
![]() |
...
|
buffer | 2 | 0x0060D000 | 0x0060FFFF | First Network Behavior |
![]() |
32-bit | - |
![]() |
...
|
sowavpiyaacf.exe | 2 | 0x00400000 | 0x00403FFF | First Network Behavior |
![]() |
32-bit | 0x0040211B |
![]() |
...
|
sowavpiyaacf.exe | 2 | 0x00400000 | 0x00403FFF | Process Termination |
![]() |
32-bit | - |
![]() |
...
|
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
Shellcode_GetPC_fstenv | x86 GetPC code using fstenv; possible shellcode | - |
3/5
|
...
|
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\uproof\custom.dic | Dropped File | Text |
Clean
|
...
|
»