URL Details

URL
http://mqslotyzyovy.com/

Score

This url shows some signs of potential malicious behavior.

The score of this url is 1.6 out of 10.

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Information on Execution

Category Started Completed Duration Logs
URL Feb. 21, 2019, 8:32 p.m. Feb. 21, 2019, 8:34 p.m. 124 seconds

Machine

Name Label Started On Shutdown On
winxpsp3x86 winxpsp3x86 2019-02-21 20:32:51 2019-02-21 20:34:54

Analyzer Log

2019-02-22 04:32:47,000 [analyzer] DEBUG: Starting analyzer from: C:\kntdebmz
2019-02-22 04:32:47,030 [analyzer] DEBUG: Pipe server name: \\.\PIPE\aUxeFSfBwCtpLSckxHEeizdnZb
2019-02-22 04:32:47,030 [analyzer] DEBUG: Log pipe server name: \\.\PIPE\aXfPgDQMLehuFJJSWgaSlNVhGMkw
2019-02-22 04:32:49,358 [analyzer] DEBUG: Started auxiliary module Disguise
2019-02-22 04:32:49,500 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-02-22 04:32:49,500 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-02-22 04:32:49,562 [analyzer] DEBUG: Loaded monitor into process with pid 700
2019-02-22 04:32:49,562 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2019-02-22 04:32:49,562 [analyzer] DEBUG: Started auxiliary module Human
2019-02-22 04:32:49,562 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2019-02-22 04:32:49,562 [analyzer] DEBUG: Started auxiliary module Reboot
2019-02-22 04:32:49,858 [analyzer] DEBUG: Started auxiliary module RecentFiles
2019-02-22 04:32:49,858 [analyzer] DEBUG: Started auxiliary module Screenshots
2019-02-22 04:32:50,125 [lib.api.process] INFO: Successfully executed process from path 'C:\\Program Files\\Microsoft Office\\Office12\\POWERPNT.EXE' with arguments ['/S', 'http://mqslotyzyovy.com/'] and pid 1596
2019-02-22 04:32:50,421 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-02-22 04:32:50,421 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-02-22 04:32:50,483 [analyzer] DEBUG: Loaded monitor into process with pid 1596
2019-02-22 04:32:51,233 [analyzer] INFO: Added new file to list with pid 1596 and path C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa12.dat
2019-02-22 04:32:52,750 [analyzer] INFO: Added new file to list with pid 1596 and path \Device\NamedPipe\lsass
2019-02-22 04:32:53,046 [analyzer] INFO: Added new file to list with pid 1596 and path \Device\NamedPipe\ROUTER
2019-02-22 04:33:08,328 [analyzer] CRITICAL: Encountered an unknown process while in monitoring mode: /S /C {BDEADF00-C265-11D0-BCED-00A0C90AB50F} /I {000214E6-0000-0000-C000-000000000046} /X 0x401!
2019-02-22 04:33:08,390 [analyzer] INFO: Injected into process with pid 1584 and name u'verclsid.exe'
2019-02-22 04:33:08,483 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-02-22 04:33:08,483 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-02-22 04:33:08,592 [analyzer] DEBUG: Loaded monitor into process with pid 1584
2019-02-22 04:33:10,703 [lib.api.process] INFO: Memory dump of process with pid 1584 completed
2019-02-22 04:33:11,171 [analyzer] INFO: Process with pid 1584 has terminated
2019-02-22 04:34:29,015 [modules.auxiliary.human] INFO: Found button "OK", clicking it
2019-02-22 04:34:30,140 [analyzer] INFO: Added new file to list with pid 1596 and path C:\Documents and Settings\zamen\Application Data\Microsoft\Office\PowerP12.pip
2019-02-22 04:34:30,421 [analyzer] INFO: Process with pid 1596 has terminated
2019-02-22 04:34:30,421 [analyzer] INFO: Process list is empty, terminating analysis.
2019-02-22 04:34:31,421 [analyzer] INFO: Terminating remaining processes before shutdown.
2019-02-22 04:34:31,421 [analyzer] WARNING: File at path "u'\\device\\namedpipe\\lsass'" does not exist, skip.
2019-02-22 04:34:31,421 [analyzer] WARNING: File at path "u'\\device\\namedpipe\\router'" does not exist, skip.
2019-02-22 04:34:31,437 [analyzer] INFO: Analysis completed.

Cuckoo Log

2019-02-21 20:32:51,405 [lib.cuckoo.core.scheduler] INFO: Task #1285: acquired machine winxpsp3x86 (label=winxpsp3x86)
2019-02-21 20:32:51,430 [modules.auxiliary.sniffer] INFO: Started sniffer with PID 23217 (interface=eth2, host=192.168.128.101, pcap=/opt/cuckoo/storage/analyses/1285/dump.pcap)
2019-02-21 20:33:02,352 [lib.cuckoo.core.guest] INFO: Starting analysis on guest (id=winxpsp3x86, ip=192.168.128.101)
2019-02-21 20:34:52,690 [lib.cuckoo.core.guest] INFO: winxpsp3x86: analysis completed successfully
2019-02-21 20:35:31,093 [lib.cuckoo.core.plugins] WARNING: The processing module "Suricata" returned the following error: Unable to locate Suricata binary
2019-02-21 20:35:32,510 [elasticsearch] WARNING: HEAD http://127.0.0.1:9200/_template/cuckoo_template [status:N/A request:0.000s]
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 94, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 643, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/lib/python2.7/dist-packages/urllib3/util/retry.py", line 251, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 361, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/lib/python2.7/httplib.py", line 1017, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.7/httplib.py", line 1051, in _send_request
    self.endheaders(body)
  File "/usr/lib/python2.7/httplib.py", line 1013, in endheaders
    self._send_output(message_body)
  File "/usr/lib/python2.7/httplib.py", line 864, in _send_output
    self.send(msg)
  File "/usr/lib/python2.7/httplib.py", line 826, in send
    self.connect()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 163, in connect
    conn = self._new_conn()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 147, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f937f7e62d0>: Failed to establish a new connection: [Errno 111] Connection refused
2019-02-21 20:35:32,511 [elasticsearch] WARNING: HEAD http://127.0.0.1:9200/_template/cuckoo_template [status:N/A request:0.000s]
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 94, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 643, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/lib/python2.7/dist-packages/urllib3/util/retry.py", line 251, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 361, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/lib/python2.7/httplib.py", line 1017, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.7/httplib.py", line 1051, in _send_request
    self.endheaders(body)
  File "/usr/lib/python2.7/httplib.py", line 1013, in endheaders
    self._send_output(message_body)
  File "/usr/lib/python2.7/httplib.py", line 864, in _send_output
    self.send(msg)
  File "/usr/lib/python2.7/httplib.py", line 826, in send
    self.connect()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 163, in connect
    conn = self._new_conn()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 147, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f937f7e69d0>: Failed to establish a new connection: [Errno 111] Connection refused
2019-02-21 20:35:32,512 [elasticsearch] WARNING: HEAD http://127.0.0.1:9200/_template/cuckoo_template [status:N/A request:0.000s]
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 94, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 643, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/lib/python2.7/dist-packages/urllib3/util/retry.py", line 251, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 361, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/lib/python2.7/httplib.py", line 1017, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.7/httplib.py", line 1051, in _send_request
    self.endheaders(body)
  File "/usr/lib/python2.7/httplib.py", line 1013, in endheaders
    self._send_output(message_body)
  File "/usr/lib/python2.7/httplib.py", line 864, in _send_output
    self.send(msg)
  File "/usr/lib/python2.7/httplib.py", line 826, in send
    self.connect()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 163, in connect
    conn = self._new_conn()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 147, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f937f7e6510>: Failed to establish a new connection: [Errno 111] Connection refused
2019-02-21 20:35:32,513 [elasticsearch] WARNING: HEAD http://127.0.0.1:9200/_template/cuckoo_template [status:N/A request:0.000s]
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 94, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 643, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/lib/python2.7/dist-packages/urllib3/util/retry.py", line 251, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 361, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/lib/python2.7/httplib.py", line 1017, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.7/httplib.py", line 1051, in _send_request
    self.endheaders(body)
  File "/usr/lib/python2.7/httplib.py", line 1013, in endheaders
    self._send_output(message_body)
  File "/usr/lib/python2.7/httplib.py", line 864, in _send_output
    self.send(msg)
  File "/usr/lib/python2.7/httplib.py", line 826, in send
    self.connect()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 163, in connect
    conn = self._new_conn()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 147, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f937f7e6350>: Failed to establish a new connection: [Errno 111] Connection refused
2019-02-21 20:35:32,513 [lib.cuckoo.core.plugins] ERROR: Failed to run the reporting module "ElasticSearch":
Traceback (most recent call last):
  File "/opt/cuckoo/lib/cuckoo/core/plugins.py", line 533, in process
    current.run(self.results)
  File "/opt/cuckoo/modules/reporting/elasticsearch.py", line 196, in run
    self.connect()
  File "/opt/cuckoo/modules/reporting/elasticsearch.py", line 79, in connect
    if not self.es.indices.exists_template("cuckoo_template"):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/client/utils.py", line 69, in _wrapped
    return func(*args, params=params, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/client/indices.py", line 491, in exists_template
    name), params=params)
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/transport.py", line 327, in perform_request
    status, headers, data = connection.perform_request(method, url, params, body, ignore=ignore, timeout=timeout)
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 105, in perform_request
    raise ConnectionError('N/A', str(e), e)
ConnectionError: ConnectionError(<urllib3.connection.HTTPConnection object at 0x7f937f7e6350>: Failed to establish a new connection: [Errno 111] Connection refused) caused by: NewConnectionError(<urllib3.connection.HTTPConnection object at 0x7f937f7e6350>: Failed to establish a new connection: [Errno 111] Connection refused)

Signatures

Libraries known to be associated with a CVE were requested (may be False Positive) (1 event)
cve CVE-2013-3906
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)
dead_host 192.158.197.132:3460

Network

DNS

Name Response Post-Analysis Lookup
time.windows.com
mqslotyzyovy.com

Summary

Process verclsid.exe (1584)

Process POWERPNT.EXE (1596)

  • Opened files

    • C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Cultures\OFFICE.ODF
    • C:\
    • C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\rasphone.pbk
    • C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\
    • c:\AUTOEXEC.BAT
    • C:\Program Files\Microsoft Office\Office12\ID_00030.DPC
    • C:\WINDOWS\system32\oleacc.dll
    • C:\Documents and Settings\zamen\Local Settings\Temporary Internet Files\Content.MSO
    • C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\OPA12.BAK
    • C:\Documents and Settings\zamen\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    • C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\
    • C:\WINDOWS\system32\ras\
    • C:\Program Files\Microsoft Office\Office12\POWERPOI.PIP
    • C:\WINDOWS\system32\shell32.dll
    • C:\Documents and Settings\zamen\Cookies\index.dat
    • C:\Documents and Settings\zamen\Cookies\
    • C:\Documents and Settings\zamen\
    • \\?\PIPE\lsarpc
    • C:\WINDOWS\system32\tapi32.dll
    • C:\Program Files\Common Files\System\ado\msadox.dll
    • C:\WINDOWS\system32\mlang.dll
    • C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa12.dat
    • \\?\PIPE\ROUTER
    • C:\WINDOWS\system32\wininet.dll
    • C:\WINDOWS\AppPatch\sysmain.sdb
    • C:\WINDOWS\system32\urlmon.dll
    • C:\Documents and Settings\
    • C:\Documents and Settings\zamen\Local Settings\History
    • C:\Program Files\
    • C:\Program Files\Common Files\Microsoft Shared\OFFICE12\1033\ALRTINTL.DLL
    • C:\Documents and Settings\zamen\Local Settings\Temporary Internet Files\P6QZO39W\4TEGG963\Offline\
    • C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSONSEXT.DLL
    • C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll
    • \??\FDC#GENERIC_FLOPPY_DRIVE#6&1435b2e2&0&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
    • C:\Documents and Settings\zamen\Local Settings\History\History.IE5\
    • C:\Documents and Settings\zamen\Local Settings\Temporary Internet Files\P6QZO39W\4TEGG963\Offline\0x00000003_R
    • C:\WINDOWS\WindowsShell.Manifest
    • C:\Documents and Settings\zamen\Local Settings\Temporary Internet Files
    • C:\Documents and Settings\zamen\Local Settings\Temporary Internet Files\Content.IE5\
    • C:\WINDOWS\system32
    • C:\Documents and Settings\zamen\Local Settings\History\History.IE5\index.dat
    • C:\Program Files\Common Files\Microsoft Shared\Web Folders\
  • Written files

    • \\?\PIPE\lsarpc
    • C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa12.dat
    • C:\Documents and Settings\zamen\Application Data\Microsoft\Office\PowerP12.pip
    • \\?\PIPE\ROUTER

Process verclsid.exe (1584)

  • Registry keys read

    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Process POWERPNT.EXE (1596)

Process verclsid.exe (1584)

Process POWERPNT.EXE (1596)

Process verclsid.exe (1584)

Process POWERPNT.EXE (1596)

Process verclsid.exe (1584)

Process POWERPNT.EXE (1596)

  • Processes created

    • /S /C {BDEADF00-C265-11D0-BCED-00A0C90AB50F} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
  • DLLs Loaded

    • C:\WINDOWS\system32\IMM32.DLL
    • C:\WINDOWS\system32\SHELL32.dll
    • sensapi.dll
    • RASAPI32.DLL
    • urlmon.dll
    • Shlwapi.DLL
    • C:\WINDOWS\system32\ADVAPI32.DLL
    • DNSAPI.dll
    • C:\Program Files\Common Files\Microsoft Shared\office12\1033\MSOINTL.DLL
    • kernel32.dll
    • UxTheme.dll
    • oleaut32.dll
    • netapi32.dll
    • ntdll.dll
    • shlwapi.dll
    • C:\WINDOWS\system32\msv1_0.dll
    • winspool.drv
    • C:\WINDOWS\system32\mswsock.dll
    • URLMON.DLL
    • rasadhlp.dll
    • OLEAUT32.dll
    • WININET.dll
    • C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\msonpui.dll
    • C:\Program Files\Microsoft Office\Office12\POWERPNT.EXE
    • UxTheme.DLL
    • OLE32
    • OLEAUT32.DLL
    • C:\WINDOWS\system32\KERNEL32.DLL
    • advapi32.dll
    • ole32.dll
    • USERENV.dll
    • C:\Program Files\Common Files\Microsoft Shared\office12\riched20.dll
    • Comctl32.dll
    • C:\Program Files\Common Files\Microsoft Shared\OFFICE12\OGL.DLL
    • IMM32.dll
    • RASMAN.DLL
    • MSO.dll
    • wsock32
    • RTUTILS.DLL
    • VERSION.DLL
    • C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\msonpdrv.dll
    • WININET.DLL
    • shell32.dll
    • Kernel32.DLL
    • secur32.dll
    • WTSAPI32.DLL
    • C:\WINDOWS\system32\ole32.dll
    • C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSORES.DLL
    • SHELL32.dll
    • SHLWAPI.DLL
    • mlang.dll
    • C:\WINDOWS\System32\wshtcpip.dll
    • comctl32.dll
    • Shlwapi.dll
    • mso.dll
    • C:\WINDOWS\system32\mscoree.dll
    • C:\Program Files\Microsoft Office\Office12\1033\PPINTL.DLL
    • WINMM.dll
    • appHelp.dll
    • ws2_32
    • HLINK.DLL
    • hnetcfg.dll
    • C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll
    • SHELL32.DLL
    • rpcrt4.dll
    • OLE32.DLL
    • SETUPAPI.dll
    • WS2_32.dll
    • C:\WINDOWS\System32\mswsock.dll
    • Winspool.DRV
No static analysis available.
No antivirus signatures available.

Process Tree


POWERPNT.EXE, PID: 1596, Parent PID: 1628

default registry file network process services synchronisation iexplore office pdf

verclsid.exe, PID: 1584, Parent PID: 1596

default registry file network process services synchronisation iexplore office pdf

Deprecation note: While processing this analysis you did not have the httpreplay Python library installed. Installing this library (i.e., pip install httpreplay) will allow Cuckoo to do more proper PCAP analysis including but not limited to showing full HTTP and HTTPS (!) requests and responses. It is recommended that you install this library and possibly reprocess any interesting analysis tasks.

DNS

Name Response Post-Analysis Lookup
time.windows.com
mqslotyzyovy.com

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.128.101 1025 192.168.128.111 53
192.168.128.101 1042 192.168.128.111 53
192.168.128.101 137 192.168.128.255 137
192.168.128.101 138 192.168.128.255 138
192.168.128.101 1036 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name 5745c477a5209e88_powerp12.pip
Filepath C:\Documents and Settings\zamen\Application Data\Microsoft\Office\PowerP12.pip
Size 1.4KB
Processes 1596 (POWERPNT.EXE)
Type data
MD5 230f0a9f6adaea4b045ea65171e0fcb6
SHA1 012cf7a476e7354f2378c8c6341ffbc62bbd01c6
SHA256 5745c477a5209e884c93ff030eb89dc3be104c575dd64126b1a5b0988bf0aad3
CRC32 B2C79812
ssdeep 24:kzSV1glbWa1UqylJZzwA6K2vmmXIEueSA7FfjSeMemiefs8RPZzXB+6Gto1rYd+X:kzSV1Ht7FlDzmXNA5iefsQBLB+Fo1rYe
Yara None matched
VirusTotal Search for analysis
Name 3d5bc0c3c759609b_opa12.dat
Filepath C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa12.dat
Size 8.0KB
Processes 1596 (POWERPNT.EXE)
Type data
MD5 0e7e24ed21bd5da96b0d882d5a043ad4
SHA1 543bba04369e50dfb74d27d24e1069810a5707ea
SHA256 3d5bc0c3c759609b3637e8efb7508600ec8a175e601779916097537c80092f2d
CRC32 E4BF56FA
ssdeep 192:12xaaUyse71abxl0fatpNnxa/2WvVJBZHp5isu/dY/tBNLqu5Xw2a:12x3slgatpNnxZGplu1Yte2ba
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.
Task ID 1285
Mongo ID 5c6f51e411d30812ab71f7b1
Cuckoo release 2.0-dev