81f1a5fa...beee | VTI
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Backdoor, Dropper, Downloader

81f1a5faaa792952e49c477f54c75beec7fd03d3a1c250db2b863ec2b669beee (SHA256)

Dokumente-UOM36417800369487.doc

Word Document

Created at 2018-08-01 10:16:00

...

Notifications (1/1)

The maximum number of reputation URL requests (10 per analysis) was exceeded. As a result, the reputation status could not be queried for all contacted URLs. In order to get the reputation status for all contacted URLs, please increase the 'Max URL Requests' setting in the system configurations.

Severity Category Operation Classification
5/5
Injection Writes into the memory of a process running from a created or modified executable -
  • "c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe" modifies memory of "c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe"
    ...
5/5
Injection Modifies control flow of a process running from a created or modified executable -
  • "c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe" alters context of "c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe"
    ...
5/5
Network Sets up server that accepts incoming connections Backdoor
4/5
Process Creates process -
  • Creates process ""C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F833.tmp"".
    ...
  • Creates process ""C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" "C:\Users\BGC6U8~1\AppData\Local\Temp\F843.tmp"".
    ...
  • Creates process ""C:\Users\BGC6u8Oy yXGxkR\AppData\Local\Microsoft\Windows\aeroroyale.exe" /scomma "C:\Users\BGC6U8~1\AppData\Local\Temp\F854.tmp"".
    ...
4/5
Information Stealing Reads browser data -
4/5
Network Downloads data Downloader
3/5
Network Performs DNS request -
3/5
Browser Reads data related to browsing history -
3/5
Browser Reads data related to saved browser credentials -
3/5
PE Executes dropped PE file -
  • Executes dropped file "c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe".
    ...
2/5
File System Known suspicious file -
  • File "C:\Users\BGC6u8Oy yXGxkR\Desktop\Dokumente-UOM36417800369487.doc" is a known suspicious file.
    ...
  • File "c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe" is a known suspicious file.
    ...
2/5
Network Connects to HTTP server -
2/5
PE Drops PE file Dropper
  • Drops file "c:\users\bgc6u8oy yxgxkr\appdata\local\microsoft\windows\aeroroyale.exe".
    ...
2/5
VBA Macro Executes macro on specific worksheet event -
  • Executes macro automatically on target "auto" and event "open".
    ...
1/5
Process Creates system object -
1/5
Static Unparsable sections in file -
  • Static analyzer was unable to completely parse the analyzed file: C:\Users\BGC6u8Oy yXGxkR\Desktop\Dokumente-UOM36417800369487.doc.
    ...
1/5
Static Contains suspicious meta data -
1/5
VBA Macro Contains Office macro -
1/5
Network Associated with known malicious/suspicious URLs -
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image