a3eca35d14b0e020444186a5faaba5997994a47af08580521f808b1bb83d6063
Classification: Malicious
a3eca35d14b0e020444186a5faaba5997994a47af08580521f808b1bb83d6063 is a trojan (Word document, 197.4 KB). Flagged by 42% of antivirus engines (58 detections).
Detection summary
- 58 antivirus detections (42% detection ratio)
- 0 IDS alerts
- 1 processes observed
- 1 contacted hosts
- 1 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic Malware |
Cyber Threat Alliance |
2026-09-09 10:12:51 |
2026-10-10 10:16:28 |
malicious-activity
|
|
| Roaming Mantis |
Maltiverse |
2023-04-13 04:20:43 |
2023-04-14 02:04:24 |
malicious-activity
|
|
| Invisimole |
Maltiverse |
2023-03-31 04:13:54 |
2023-04-01 00:17:31 |
malicious-activity
|
S0260 InvisiMole
|
| Ghostwriter |
Maltiverse |
2023-03-31 04:13:54 |
2023-04-01 00:17:25 |
malicious-activity
|
|
| CVE-2017-0199 |
Hybrid-Analysis |
2020-05-07 17:15:21 |
2020-05-07 17:15:21 |
|
|
Sample information
- Filenames
- a3eca35d14b0e020444186a5faaba5997994a47af08580521f808b1bb83d6063
- File type
- Microsoft Word 2007+
- Size
- 202126 bytes
- MD5
183ad96b931733ad37bb627a958837db- SHA-1
7f8455524bd987f5a0ef887d73092c72bdcd1aea- SHA-256
a3eca35d14b0e020444186a5faaba5997994a47af08580521f808b1bb83d6063- First indexed
- 2020-05-07 17:15:21
- Last updated
- 2025-12-04 00:42:38
Antivirus detections
| Engine | Detection |
|---|
| Alibaba | Exploit:Office97/CVE-2017-0199.11725883 |
| Cyren | Trojan.BYKZ-2 |
| Symantec | Trojan.Mdropper |
| ESET-NOD32 | DOC/TrojanDownloader.Agent.ARJ |
| TrendMicro-HouseCall | TROJ_FRS.0NA104DU20 |
| Avast | Other:Malware-gen [Trj] |
| Kaspersky | HEUR:Trojan-Dropper.MSOffice.SDrop.gen |
| NANO-Antivirus | Exploit.Xml.CVE-2017-0199.equmby |
| ViRobot | DOC.S.Exploit.202126 |
| Tencent | Win32.Trojan-downloader.Agent.Dxdi |
| Sophos | Troj/DocDl-YMB |
| F-Secure | Malware.W97M/Dldr.Agent.lbjri |
| TrendMicro | TROJ_FRS.0NA104DU20 |
| McAfee-GW-Edition | Artemis!Trojan |
| Ikarus | Trojan-Downloader.DOC.Agent |
| Avira | W97M/Dldr.Agent.lbjri |
| Antiy-AVL | Trojan[Dropper]/MSOffice.SDrop |
| Microsoft | Exploit:O97M/CVE-2017-0199!MTB |
| AegisLab | Trojan.MSOffice.SDrop.b!c |
| ZoneAlarm | HEUR:Trojan-Dropper.MSOffice.SDrop.gen |
| GData | Macro.Trojan.Agent.18XO4N |
| AhnLab-V3 | Downloader/Doc.Generic |
| ALYac | Trojan.Downloader.DOC.Gen |
| MAX | malware (ai score=99) |
| AVG | Other:Malware-gen [Trj] |
| Qihoo-360 | Generic/Trojan.Dropper.be6 |
| Alibaba | TrojanDropper:Office/SDrop.11cabcca |
| Antiy-AVL | Trojan[APT]/MSWord.Lazarus |
| Arcabit | Trojan.Agent.ESKK |
| Avira | W2000M/Agent.BL |
| BitDefender | Trojan.Agent.ESKK |
| CAT-QuickHeal | XML.APT.37714 |
| CTX | docx.trojan.office |
| ClamAV | Win.Malware.Agent-8366117-0 |
| Cynet | Malicious (score: 99) |
| DrWeb | W97M.DownLoader.5684 |
| ESET-NOD32 | DOC/TrojanDownloader.Pterodo.A trojan |
| Emsisoft | Trojan.Agent.ESKK (B) |
| F-Secure | Malware.W2000M/Agent.BL |
| Fortinet | MSOffice/RemoteTemplate.gen |
| GData | Trojan.Agent.ESKK |
| Google | Detected |
| K7AntiVirus | Trojan ( 0001140e1 ) |
| K7GW | Trojan ( 0001140e1 ) |
| Lionic | Trojan.MSWord.Office.b!c |
| MicroWorld-eScan | Trojan.Agent.ESKK |
| Microsoft | Ransom:Win32/CVE |
| Skyhigh | Generic Dropper.aou |
| TACHYON | Suspicious/WOX.Downloader.Gen |
| Tencent | Trojan.Win32.Office_Dl.11024649 |
| TrellixENS | Generic Dropper.aou |
| TrendMicro | Trojan.W97M.NSTAR.A |
| TrendMicro-HouseCall | Trojan.W97M.NSTAR.A |
| VIPRE | Trojan.Agent.ESKK |
| Varist | CVE170199 |
| ZoneAlarm | Troj/DocDl-YMB |
| alibabacloud | Trojan[dropper]:MSOffice/Pterodo.A |
| huorong | Trojan/Generic!14B414A67A58DEF5 |
Process list
| Name | Command line |
|---|
| WINWORD.EXE | /n "C:\a3eca35d14b0e020444186a5faaba5997994a47af08580521f808b1bb83d6063.doc" |