f77e4eebda4d50f76a4ad15f59f4f493928555e74fd680dd4a226121498c342d File Analysis Results

Metadata

File name:	SecureMessage.doc
File type:	doc
File size:	67072 bytes
Analysis date:	Analyzed on August 11 2017 14:03:00
MD5:	871782f6da3366d630caa88deee3128b
SHA1:	1ca6bd481ca8b15ebaf05220cf6de6cb14a564f2
SHA256:	f77e4eebda4d50f76a4ad15f59f4f493928555e74fd680dd4a226121498c342d
SHA512:	fa7077f544e1882ceacb163691044e5b2574ab5d7c4c43dade36012d5ebfcc33b3cf2f6ccce4452b84e8b727460a2e9151a8f16e5f0c4607d4e711766055cbcd
SSDEEP:	N/A
IMPHASH:	N/A
Authentihash:	N/A
Related resources

APTNotes
Cyber threat intelligence reports associated with f77e4eebda4d50f76a4ad15f59f4f493928555e74fd680dd4a226121498c342d.

Domains
Domains the malware sample communicates with.

Domain	IP
200.47.70.193.cbl.abuseat.org	Address
Address	103 Sham Peng Tong Plaza
City	Victoria
Country	SC
Creation Date	Sat, 23 Feb 2002 00:50:34 GMT
DNSSEC	unsigned
Domain Name	ABUSEAT.ORG
EMail	N/A
EMail	N/A
Expiration Date	Fri, 23 Feb 2018 00:50:34 GMT
name	CBL Hostmaster
Name Server	NS3.SPAMHAUS.ORG
Name Server	MUSASHI.SPAMHAUS.ORG
Organization	CBL, a division of Spamhaus
Reigstrar	Gandi SAS
Status	clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Last Update	Sun, 22 Jan 2017 22:59:46 GMT
Zip Code	Mahe
checkip.amazonaws.com	Address
Address	PO BOX 81226
City	Seattle
Country	US
Creation Date	Thu, 18 Aug 2005 00:00:00 GMT
Creation Date	Wed, 17 Aug 2005 19:10:45 GMT
DNSSEC	unsigned
Domain Name	AMAZONAWS.COM
EMail	N/A
EMail	N/A
Expiration Date	Thu, 16 Jan 2020 00:00:00 GMT
Expiration Date	Wed, 15 Jan 2020 00:00:00 GMT
name	Legal Department
Name Server	R2.AMAZONAWS.COM
Organization	Amazon.com, Inc.
Referral URL	http://www.markmonitor.com
Reigstrar	MarkMonitor, Inc.
State	WA
Status	clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Status	clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Last Update	Thu, 05 May 2016 00:00:00 GMT
Last Update	Thu, 05 May 2016 16:11:07 GMT
Whois Server	whois.markmonitor.com
Zip Code	98108-1226
	16318f7c2d6b102ca705cd89acc3fa577a80333ac55fd433fd3e08dfbc7b2115
	128b96e958e19b9cfe1c02a4e0467cdb18f89507fdf5cffbfd2ff4bcd147149f
	5c7edc44f69b5c8272fa6d2dd260364964c71cbfbcfabafb14eae2c26a013d41
	402ea58b77c6ce5e5ccaa272a38dc7698829600a48cfdbbedf9fb0315fa97baf
	cab733e3f381273982808ef11f0578fcc3eebbfc99fa868d2acf42db53e3407b
usdata.estoreseller.com	Address
Address	1673 E 16 St. 22,
City	Brooklyn
Country	US
Creation Date	Mon, 06 Feb 2012 09:39:11 GMT
DNSSEC	unsigned
Domain Name	ESTORESELLER.COM
EMail	N/A
EMail	N/A
Expiration Date	Tue, 06 Feb 2018 09:39:11 GMT
name	Elton John
Name Server	VENUS2.IDEASERVERS.NET
Organization	ZeeServers Inc.
Reigstrar	PDR Ltd. d/b/a PublicDomainRegistry.com
State	New York
Status	clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Last Update	Thu, 02 Feb 2017 04:53:04 GMT
Last Update	Thu, 02 Feb 2017 04:53:08 GMT
Whois Server	whois.publicdomainregistry.com
Zip Code	11229
200.47.70.193.zen.spamhaus.org	Address
Address	Avenue Louis-Casai 18
City	Geneva
Country	CH
Creation Date	Fri, 01 Oct 1999 11:03:57 GMT
DNSSEC	unsigned
Domain Name	SPAMHAUS.ORG
EMail	N/A
EMail	N/A
Expiration Date	Thu, 01 Oct 2020 11:03:57 GMT
name	Steve Linford
Name Server	NS20.JA.NET
Name Server	MUSASHI.SPAMHAUS.ORG
Organization	The Spamhaus Project
Reigstrar	Gandi SAS
Status	clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Last Update	Sat, 07 Jan 2017 11:04:21 GMT
Zip Code	1209

Hosts
Hosts the malware sample communicates with.

HTTP Requests
HTTP requests the malware sample makes.

Host	URL	User-Agent
138.201.61.81 (usdata.estoreseller.com)	/images/logo.png
N/A
N/A
N/A
107.20.242.236 (checkip.amazonaws.com)	/	Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
N/A
N/A
N/A

AV Detections
AV detection names associated with the malware sample.

Mutants
Mutants created by the malware sample.

"\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906"

"Local\10MU_ACB10_S-1-5-5-0-57987"

"Global\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000"

"Global\MsoShellExtRegAccess_S-1-5-21-4162757579-3804539371-4239455898-1000"

"Local\10MU_ACBPIDS_S-1-5-5-0-57987"

"Local\ZonesLockedCacheCounterMutex"

"Local\ZonesCounterMutex"

"Global\552FFA80-3393-423d-8671-7BA046BB5906"

"Local\ZoneAttributeCacheCounterMutex"

"Local\ZonesCacheCounterMutex"

"Global\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000"

"\Sessions\1\BaseNamedObjects\Local\10MU_ACBPIDS_S-1-5-5-0-57987"

"\Sessions\1\BaseNamedObjects\Local\10MU_ACB10_S-1-5-5-0-57987"

"\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex"

"\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex"

"\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"

"\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"

"\Sessions\1\BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000"

"\Sessions\1\BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000"

"\Sessions\1\BaseNamedObjects\Global\MsoShellExtRegAccess_S-1-5-21-4162757579-3804539371-4239455898-1000"

Registry keys
Registry keys created by the malware sample.

Comments
User comments about f77e4eebda4d50f76a4ad15f59f4f493928555e74fd680dd4a226121498c342d.

Contextual information

File: f77e4eebda4d50f76a4ad15f59f4f493928555e74fd680dd4a226121498c342d