home

WinWord.exe

2007 Microsoft Office system

Microsoft Corporation

The WinWord executable is the primary user interface for Microsoft Word. The file is part of Microsoft Office 2007. This is a setup program which is used to install the application. It runs as a scheduled task under the Windows Task Scheduler. This is installed with multiple programs including Microsoft Office Language Pack 2007 - German/Deutsch and Microsoft Office Enterprise 2007. The file has been seen being downloaded from mail.ipc.srv.br and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
2007 Microsoft Office system

Description:
Microsoft Office Word

Version:
12.0.4518.1014

MD5:
ceaa5817a65e914aa178b28f12359a46

SHA-1:
534a7ea9c67bab3e8f2d41977bf43d41dfe951cf

SHA-256:
6c959cfb001fbb900958441dfd8b262fb33e052342948bab338775d3e83ef7f7

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
11/16/2024 5:53:24 AM UTC  (today)

File size:
339.3 KB (347,432 bytes)

Product version:
12.0.4518.1014

Copyright:
© 2006 Microsoft Corporation. All rights reserved.

Original file name:
WinWord.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\microsoft office\office12\winword.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
4/4/2006 9:43:46 PM

Valid to:
10/4/2007 9:53:46 PM

Subject:
CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, OU=Copyright (c) 2000 Microsoft Corp., O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
61469ECB000400000065

File PE Metadata
Compilation timestamp:
10/27/2006 11:54:48 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:tlsHe0BivO39zYpmH+kAzkA7ZUgbc6AYJ8rEdrEbAgMMV6NX5ZNeVgjYf:InIO39YAeNLFjAYarEdrEb5P6VxY

Entry address:
0x10CC

Entry point:
E8, 05, 00, 00, 00, E9, DD, 00, 00, 00, 55, 8B, EC, 83, EC, 14, 53, 56, 57, 68, A0, 11, 00, 30, 68, 84, 11, 00, 30, FF, 15, 38, 10, 00, 30, 50, FF, 15, 04, 10, 00, 30, 8B, F0, 85, F6, 74, 0F, 6A, 00, 6A, 00, 6A, 01, FF, 15, 3C, 10, 00, 30, 50, FF, D6, 8D, 45, F4, 50, FF, 15, 40, 10, 00, 30, 8B, 75, F8, 33, 75, F4, FF, 15, 44, 10, 00, 30, 33, F0, FF, 15, 48, 10, 00, 30, 33, F0, FF, 15, 4C, 10, 00, 30, 33, F0, 8D, 45, EC, 50, FF, 15, 50, 10, 00, 30, 8B, 45, F0, 33, 45, EC, 8B, 3D, 54, 10, 00, 30, 33, F0, 8D...
 
[+]

Code size:
5 KB (5,120 bytes)

Scheduled Task
Task name:
{CDEA7624-94CB-4AE6-BB90-518DE599B629}

Trigger:
Registration (Runs on registration)


Shell Open Command
Open type:
wordhtmlfile

Command:
"C:\Program Files\microsoft office\office12\winword.exe"


Windows Firewall Allowed Program
Name:
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE


The file WinWord.exe has been discovered within the following programs.

2007 Microsoft Office system  by Microsoft Corporation
2007 Microsoft Office System is a Windows version of the Microsoft Office System, Microsoft's productivity suite. The 'Ribbon User Interface' is a task-oriented Graphical User Interface (GUI). It features a central menu button, widely known as the 'Office Button'.
www.microsoft.com
6% remove it
Microsoft Office Enterprise 2007  by Microsoft Corporation
Office Enterprise 2007 is a version of Microsoft Office, a family of office suites and productivity software for Windows also named Office 12.
office.microsoft.com/en-us/excel
4% remove it
Microsoft Office Home and Student 2007  by Microsoft Corporation
Microsoft Office Home and Student 2007 is an office suite of desktop applications, servers and services. Microsoft Office 2007 (Office 12.0) was released in 2007.
office.microsoft.com
7% remove it
Microsoft Office Language Pack 2007 - German/Deutsch  by Microsoft Corporation
Publisher's description - “Microsoft Office Language Packs serve the needs of multilingual individuals who routinely create or edit documents and presentations in different languages.”
5% remove it
Microsoft Office Professional Plus 2007  by Microsoft Corporation
Office 2007 contains a number of new features, the most notable of which is the entirely new graphical user interface called the Fluent User Interface (initially referred to as the Ribbon User Interface), replacing the menus and toolbars – which have been the cornerstone of Office since its inception – with a tabbed toolbar, known as the Ribbon.
office.microsoft.com/en-us/professional
2% remove it
Microsoft Office Standard 2007  by Microsoft Corporation
Publisher's description - “The 2007 Microsoft Office system has evolved from a suite of personal productivity products to a more comprehensive and integrated system.”
8% remove it
Microsoft Office Word 2007  by Microsoft Corporation
Publisher's description - “Microsoft Office Home and Student 2007 is the essential software suite for home computer users and includes 2007 versions of Excel, PowerPoint, Word, and OneNote.”
4% remove it
 
Powered by Should I Remove It?

The file WinWord.exe has been seen being distributed by the following 5 URLs.

https://mail.ipc.srv.br:10443/service/home/.../?auth=co&loc=pt_BR&id=53226&part=2

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-mbV_b9nkZx6_7jlwg3XqkwKTqyvlgRjF9WqgOBrrle1IpzggUUT7kduxIHSXKbUeq2B7MtMVu5YN8JowUs90aw/messages/@.id==ACfsw0MAABzCVutWWAJJ8Bmnv1A/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBYsG5eldZyJq-uUAvZCEnAAKnEGGRI72J_yGt6UX7KElw&error=https://br-mg6.mail.yahoo.com/.../iframemsg?id=164c400e-b420-94aa-2eec-b50b369a429e&ymreqid=7af8e6f8-bf8f-9079-0151-8d0014010000

https://ud.interia.pl/.../getattach,mid,841,mpid,3,uid,daa4cce6551531f2,min,0,nd,0?f=WINWORD.EXE

https://doc-04-7c-docs.googleusercontent.com/docs/securesc/nl9nsngmvec0d48ruf89h6cl2gq0cf8a/urunjkq0685f5cv0532l04bft93b88fq/1457683200000/.../08559437373877981202/0B1KvRSqXeCEeX3JsSzIzZ2xkajQ?e=download

temp:WINWORD.EXE

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.