Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'Manuale Electrical Profile & Provisioning Manager EVO v3.2.doc'

no specific threat

not enough data to reliably determine

Manuale Electrical Profile & Provisioning Manager EVO v3.2.doc

This report is generated from a file or URL submitted to this webservice on October 7th 2015 13:46:07 (UTC)
Report generated by Falcon Sandbox v2.50 © Hybrid Analysis

Overview Sample unavailable Re-analyze Hash Seen Before

Attention: this analysis ran with the legacy Usermode Monitor. It is highly recommended to use the Kernelmode Monitor.

Request Report Deletion

Incident Response

Risk Assessment

Remote Access: Contains a remote desktop related string

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

Suspicious Indicators 4
Network Related
- Found potential URL in binary/memory
  
  details
  
  "http://docs.oracle.com/javase/specs/"
  
  source
  
  File/Memory
  
  relevance
  
  2/10
Remote Access Related
- Contains a remote desktop related string
  
  details
  
  "UG#+^j^)-vnca" (Indicator for product: Generic VNC)
  
  source
  
  File/Memory
  
  relevance
  
  10/10
Unusual Characteristics
- Contains embedded string with suspicious keywords
  
  details
  
  Found suspicious keyword "Environ" which indicates: "May read system environment variables"
  Found suspicious keyword "Lib" which indicates: "May run code from a DLL"
  Found suspicious keyword "Open" which indicates: "May open a file"
  Found suspicious keyword "Output" which indicates: "May write to a file (if combined with Open)"
  
  source
  
  File/Memory
  
  relevance
  
  10/10
- Installs hooks/patches the running process
  
  details
  
  "WINWORD.EXE" wrote bytes "BEA82A18" to virtual address "0x2FAF1634" (part of module "WINWORD.EXE")
  "WINWORD.EXE" wrote bytes "E9231920F0" to virtual address "0x77703D01" ("SetUnhandledExceptionFilter@kernel32.dll")
  
  source
  
  Hook Detection
  
  relevance
  
  10/10

Informative 4
External Systems
- Sample was identified as clean by Antivirus engines
  
  details
  
  0/57 Antivirus vendors marked sample as malicious (0% detection rate)
  
  source
  
  External System
  
  relevance
  
  10/10
General
- Creates mutants
  
  details
  
  "KYIMEShareCachedData.MutexObject.PSPUBWS"
  "KYTransactionServer.MutexObject.PSPUBWS"
  "Global\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000"
  "Global\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000"
  "Local\ZonesCounterMutex"
  "Local\ZoneAttributeCacheCounterMutex"
  "Local\ZonesCacheCounterMutex"
  "Local\ZonesLockedCacheCounterMutex"
  "Global\MsoShellExtRegAccess_S-1-5-21-4162757579-3804539371-4239455898-1000"
  
  source
  
  Created Mutant
  
  relevance
  
  3/10
- Loads rich edit control libraries
  
  details
  
  "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\Microsoft Shared\office12\riched20.dll" at 66480000
  
  source
  
  Loaded Module
Installation/Persistance
- Dropped files
  
  details
  
  "~$Normal.dotm" has type "data"
  "~WRS{A4764BF6-30DF-488C-A88E-2FF9269AA202}.tmp" has type "FoxPro FPT, blocks size 0, next free block index 218103808, 1st used item "\375""
  "opa12.dat" has type "data"
  "~$c951a6b699f4435da7bf793237803c72e61a8d2bf97966522c3b66df6fbae7.doc" has type "data"
  "~WRS{3346D57B-F125-4DC7-A375-AADFCB8A1D30}.tmp" has type "data"
  "~WRS{9D153643-B194-47B5-9B34-FB9B11E6A57A}.tmp" has type "data"
  "8cc951a6b699f4435da7bf793237803c72e61a8d2bf97966522c3b66df6fbae7.LNK" has type "MS Windows shortcut, Item id list present, Points to a file or directory, Normal, ctime=Thu Oct 8 03:46:32 2015, mtime=Thu Oct 8 03:46:32 2015, atime=Thu Oct 8 03:46:32 2015, length=5392896, window=hide"
  "index.dat" has type "data"
  "ExcludeDictionaryEN0409.lex" has type "Little-endian UTF-16 Unicode text, with no line terminators"
  "ExcludeDictionaryIT0410.lex" has type "Little-endian UTF-16 Unicode text, with no line terminators"
  
  source
  
  Binary File
  
  relevance
  
  3/10

File Details

All Details:

Manuale Electrical Profile & Provisioning Manager EVO v3.2.doc

Filename: Manuale Electrical Profile & Provisioning Manager EVO v3.2.doc
Size: 5.1MiB (5392896 bytes)
Type: doc office
Description: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: DMO.C.M.D.SC, Template: Normal.dotm, Last Saved By: Sabrina, Revision Number: 99, Name of Creating Application: Microsoft Office Word, Total Editing Time: 08:20:00, Last Printed: Sun Jun 30 11:02:00 2013, Create Time/Date: Thu Sep 26 15:06:00 2013, Last Saved Time/Date: Thu Jan 2 14:03:00 2014, Number of Pages: 43, Number of Words: 4809, Number of Characters: 27413, Security: 0
Architecture
: WINDOWS
SHA256
: 8cc951a6b699f4435da7bf793237803c72e61a8d2bf97966522c3b66df6fbae7
MD5
: 0e04c5fde7843fb12e9cf47e6d873bc1
SHA1
: aa7a847699a0699d3551bfe0add45dd717599049

Resources

Icon

Visualization

Classification (TrID)

54.2% (.DOC) Microsoft Word document
32.2% (.DOC) Microsoft Word document (old ver.)
13.5% (.) Generic OLE2 / Multistream Compound File

Screenshots

Loading content, please wait...

Hybrid Analysis

Tip: Click an analysed process below to view more details.

Analysed 1 process in total (System Resource Monitor).

WINWORD.EXE /n /dde (PID: 4004)

Logged Script Calls	Logged Stdout	Extracted Streams	Memory Dumps
Reduced Monitoring	Network Activityy	Network Error	Multiscan Match

Network Analysis

DNS Requests

No relevant DNS requests were made.

Contacted Hosts

No relevant hosts were contacted.

HTTP Traffic

No relevant HTTP requests were made.

Extracted Strings

! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~ ,ho,h/by:8L`kvor!mH>6nf[lnmw/IjS+nf=YymlM7._|t=}W>VZe9/_:^"Co{M@yRlz |BS27U )R