Malicious doc with Embedded SettingContent-ms | Network
Logo
Try VMRay Analyzer
VTI SCORE: 91/100
Dynamic Analysis Report
Classification: Trojan

3c6a74d216e10e4ff158716cfa72984230995041c4bbb7596b8c8aaa461d76c5 (SHA256)

ggzn.doc

Word Document

Created at 2018-08-06 13:03:00

...
Hosts (3)
»
Hostname IP Address Location Protocols Reputation Status WHOIS Data
ipv4only.arpa 192.0.0.170 - UDP
Unknown
Show WHOIS
- 157.56.120.207 - UDP
Not Queried
Not Queried
- 87.142.158.138 - UDP
Not Queried
Not Queried
DNS Queries (1)
»
Hostname Categories Names Source Reputation Status
ipv4only.arpa - - PCAP
Unknown

Connections

DNS (1)
»
Operation Additional Information Success Count Logfile
Resolve Name host = ipv4only.arpa, address_out = 192.0.0.170 True 1 -
UDP Sessions (2)
»
Total Data Sent 11.75 KB
Total Data Received 11.78 KB
Contacted Host Count 2
Contacted Hosts 157.56.120.207, 192.168.0.1
UDP Session #1
»
Information Value
Source PCAP
Stream ID 16
Remote Address 157.56.120.207
Remote Port 3544
Local Address 192.168.0.177
Local Port 62569
Data Sent 11.68 KB
Data Received 11.68 KB
Time Highest Layer Additional Information Success
1.620319 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
3.886299 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
5.582974 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
7.521841 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
8.027948 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
8.815405 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
11.345560 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
12.447655 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
12.617942 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
14.959363 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
16.187740 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
16.989145 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
17.553864 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
18.637573 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
19.604224 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
20.004167 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
21.100751 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
22.458565 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
25.038878 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
25.299890 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
26.967482 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
27.183869 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
28.449492 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
31.060445 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
31.162793 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
31.558359 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
33.892102 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
34.830508 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
35.964011 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
36.449685 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
37.892572 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
38.424527 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
39.740808 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
40.651041 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
40.843967 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
42.206198 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
43.069040 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
44.983270 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
45.121815 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
45.288233 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
47.425817 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
49.120427 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
50.557950 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
51.269923 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
52.571632 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
53.121504 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
54.559587 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
55.813443 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
57.373210 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
58.076786 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
60.380914 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
62.250749 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
62.565517 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
62.569798 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
64.555101 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
64.576250 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
64.610992 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
66.541643 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
66.809369 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
67.035828 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
68.809569 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
69.098772 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
70.812115 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
70.917934 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
71.051427 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
71.068337 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
72.566996 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
72.965459 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
74.562973 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
74.922709 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
75.575913 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
76.568603 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
77.037825 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
77.872659 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
79.436854 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
79.571218 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
79.590516 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
79.969249 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
81.460127 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
81.575224 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
81.584591 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
83.379383 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
83.546118 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
85.571170 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
85.920013 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
87.569350 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
88.017253 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
88.076558 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
89.863004 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
90.401728 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
90.536727 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
92.379667 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
92.573146 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
92.594602 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
93.322683 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
95.557942 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
97.542325 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
98.071019 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
99.535516 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
99.927721 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
100.074092 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
101.539664 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
101.808978 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
101.925488 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
103.893374 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
103.930373 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
104.045841 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
105.890945 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
106.439976 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
108.565990 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
108.602914 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
108.617599 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
110.565355 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
110.574203 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
112.426885 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
112.545367 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
113.082658 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
114.431674 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
115.089198 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
116.426998 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
117.319603 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
119.070435 s IPV6 Data Sent: 0.10 KB, Data Received: 0.10 KB True
UDP Session #2
»
Information Value
Source PCAP
Stream ID 25
Remote Address 192.168.0.1
Remote Port 53
Local Address 192.168.0.177
Local Port 58155
Data Sent 0.07 KB
Data Received 0.10 KB
Time Highest Layer Additional Information Success
3.796888 s DNS Data Sent: 0.07 KB, Data Received: 0.10 KB True
Exit-Icon
WHOIS Domain Information
Domain Name
WHOIS Response 

       		
      

     

    

   

  

  

  

  

   

    
    

     Function Logfile
    

    

     

      Download-Icon
     

    

    

     Exit-Icon
    

   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image