WinWord.exe

Microsoft Office 2010

Microsoft Corporation

The WinWord executable is the primary user interface for Microsoft Word. The file is part of Microsoft Office 2010. This is a setup program which is used to install the application. It runs as a scheduled task under the Windows Task Scheduler. The file has been seen being downloaded from bf1-attach.ymail.com and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft Office 2010

Description:
Microsoft Word

Version:
14.0.7125.5000

MD5:
dc77081841f1ebf04d82a863a9d0749a

SHA-1:
2f82b5cf919a4ae5ad9769d1310ec9328161cfc6

SHA-256:
bf420f5d4f07f82750ce2ad26c1d3ec37439895a1f021efa086483b7ad822cec

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
12/3/2016 3:46:35 AM UTC  (today)

File size:
1.4 MB (1,423,008 bytes)

Product version:
14.0.7125.5000

Copyright:
© 2010 Microsoft Corporation. All rights reserved.

Original file name:
WinWord.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\microsoft office\office14\winword.exe

Digital Signature
Authority:
Microsoft Corporation

Valid from:
4/22/2014 7:39:00 PM

Valid to:
7/22/2015 7:39:00 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
33000000CA6CD5321235C4E1550001000000CA

File PE Metadata
Compilation timestamp:
5/15/2014 7:39:33 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:oLZmQR3caJZLZmvNzc0TDZodoSRsfHMbvmQaO:kZmQyaJ1ZmFcqi+SRAG+4

Entry address:
0x2045

Entry point:
E8, 2C, FC, FF, FF, E9, 33, FD, FF, FF, 68, A3, 20, 00, 30, 64, FF, 35, 00, 00, 00, 00, 8B, 44, 24, 10, 89, 6C, 24, 10, 8D, 6C, 24, 10, 2B, E0, 53, 56, 57, A1, FC, 13, 00, 30, 31, 45, FC, 33, C5, 89, 45, E4, 50, 89, 65, E8, FF, 75, F8, 8B, 45, FC, C7, 45, FC, FE, FF, FF, FF, 89, 45, F8, 8D, 45, F0, 64, A3, 00, 00, 00, 00, C3, 8B, 4D, E4, 33, CD, E8, 89, FC, FF, FF, EB, 6A, 8B, FF, 55, 8B, EC, FF, 75, 14, FF, 75, 10, FF, 75, 0C, FF, 75, 08, 68, 2A, 1D, 00, 30, 68, FC, 13, 00, 30, E8, 32, 04, 00, 00, 83, C4...
 
[+]

Code size:
7.5 KB (7,680 bytes)

Scheduled Task
Task name:
{05F474BE-6D89-4485-8B92-C21A448180D5}

Trigger:
Registration (Runs on registration)


Shell Open Command
Open type:
wordhtmlfile

Command:
"C:\Program Files\microsoft office\office14\winword.exe"


The file WinWord.exe has been seen being distributed by the following 2 URLs.