input-12.20.doc
Classification: Malicious
input-12.20.doc is a malicious file sample (application/vnd.openxmlformats-officedo…, 75.2 KB). Linked to Icedid malware. 4 sightings, last seen 2020-12-07.
Detection summary
- 0 antivirus detections (16% detection ratio)
- 0 IDS alerts
- 4 processes observed
- 1 contacted hosts
- 1 DNS requests
MITRE ATT&CK associations
Malware families: ICEDID (S0483)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| IcedID | Abuse.ch | 2020-12-07 17:58:40 | 2020-12-07 17:58:40 | malicious-activity | S0483 IcedID |
| BehavesLike.Downloader | Hybrid-Analysis | 2020-12-07 14:00:21 | 2020-12-07 14:00:21 |
Tags
macros-on-openSample information
- Filenames
- input-12.20.doc
- File type
- application/vnd.openxmlformats-officedocument.wordprocessingml.document
- Size
- 77004 bytes
- MD5
4af52a67786d2366a17209b0581fdc45- SHA-1
46f29ea2973ee1e1991424696121736e8af505eb- SHA-256
aea06bc980d083aa2e2ae3ab821352033e663dc21739db859a274cf0556941f3- First indexed
- 2020-12-07 14:00:21
- Last updated
- 2026-10-09 04:16:35
Network contacts
DNS requests
Process list
| Name | Command line |
|---|---|
| WINWORD.EXE | /n "C:\input-12.20.doc" |
| rundll32.exe | url.dll,OpenURL %PUBLIC%\index.hta |
| mshta.exe | "%PUBLIC%\index.hta" |
| rundll32.exe | %ALLUSERSPROFILE%\aC7VM6.pdf,ShowDialogA -r |