322aa22163954ff3ff017014e357b756942a2a762f1c55455c83fd594e844fdd

Classification: Malicious

322aa22163954ff3ff017014e357b756942a2a762f1c55455c83fd594e844fdd is a dropper (Word document, 194.8 KB). Flagged by 6% of antivirus engines (4 detections).

Detection summary

4 antivirus detections (6% detection ratio)
0 IDS alerts
1 processes observed
1 contacted hosts
3 DNS requests

MITRE ATT&CK associations

Malware families: INVISIMOLE (S0260)

Blacklist sightings

Description	Source	First seen	Last seen	Labels	MITRE ATT&CK
Roaming Mantis	Maltiverse	2023-04-13 04:20:44	2023-04-14 02:04:22	malicious-activity
Invisimole	Maltiverse	2023-03-31 04:13:54	2023-04-01 00:17:29	malicious-activity	S0260 InvisiMole
Ghostwriter	Maltiverse	2023-03-31 04:13:55	2023-04-01 00:17:23	malicious-activity
CVE-2017-0199	Hybrid-Analysis	2020-05-05 10:15:07	2020-05-05 10:15:07

Tags

apt

Sample information

Filenames: 322aa22163954ff3ff017014e357b756942a2a762f1c55455c83fd594e844fdd
File type: Microsoft Word 2007+
Size: 199486 bytes
MD5: 9ea365c1714eb500e5f4a749a3ed0fe7
SHA-1: 20c3940dbd21464b5a1538c154a443bc858f38ad
SHA-256: 322aa22163954ff3ff017014e357b756942a2a762f1c55455c83fd594e844fdd
First indexed: 2020-05-05 10:15:07
Last updated: 2026-10-16 14:40:00

Antivirus detections

Engine	Detection
TrendMicro-HouseCall	TROJ_FRS.VSNTE520
Kaspersky	HEUR:Trojan-Dropper.MSOffice.SDrop.gen
NANO-Antivirus	Exploit.Xml.CVE-2017-0199.equmby
ZoneAlarm	HEUR:Trojan-Dropper.MSOffice.SDrop.gen

Network contacts

DNS requests

isrg.trustid.ocsp.identrust.com ocsp.int-x3.letsencrypt.org www.astedams.it

Process list

Name	Command line
WINWORD.EXE	`/n "C:\322aa22163954ff3ff017014e357b756942a2a762f1c55455c83fd594e844fdd.doc"`