Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 1, 2021, 5:04 p.m.	June 1, 2021, 5:06 p.m.

Size	5.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`7833c0f413c1611f7281ac303bcef4b3`
SHA256	`c9d7b5d06cd8ab1a01bf0c5bf41ef2a388e41b4c66b1728494f86ed255a95d48`
CRC32	`EF8DD769`
ssdeep	`49152:docG/eg7QUUZ13DhuSRprDK9bLRaHZJrVwHqQnGUWvv7rJwSI2MDc/Eb1HxTPt9I:doJegw1LELc5JV+bnQnwD70`
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)

Questions about the study of freedoms 78639846 docx.exe "C:\Users\test22\AppData\Local\Temp\Questions about the study of freedoms 78639846 docx.exe"
7388
- WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" /n /dde
  3872

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\12.0\Registration\{90120000-0030-0000-0000-0000000FF1CE}\DigitalProductID

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.itext
section	.didata

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	DOCX
resource name	EXE

Allocates read-write-execute memory (usually to unpack itself) (41 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 7388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 7388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x2f4e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x64ac1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f4c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f5de000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x64d0e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x63aa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6400a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75738000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70851000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ef1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73801000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72072000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7079f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7079f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73361000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73711000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04de0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04df0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05b41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ebe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ebe4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 1, 2021, 5:04 p.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\~$estions about the study of freedoms.docx
file	C:\Users\test22\AppData\Local\Temp\Questions about the study of freedoms.docx
file	C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile June 1, 2021, 5:04 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000002c8 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0
NtCreateFile June 1, 2021, 5:04 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000004d0 filepath: C:\Users\test22\AppData\Local\Temp\~$estions about the study of freedoms.docx desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$estions about the study of freedoms.docx create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.36405296
CAT-QuickHeal	Trojanspy.Bobik
McAfee	Artemis!7833C0F413C1
Malwarebytes	Trojan.Dropper
Zillya	Trojan.Delf.Win32.133804
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanSpy:Win32/ATRAPS.8d403978
K7GW	Spyware ( 005787421 )
K7AntiVirus	Spyware ( 005787421 )
Arcabit	Trojan.Generic.D22B8030
Cyren	W32/Trojan.SIVT-7162
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Spy.Delf.QYR
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan-Spy.Win32.Bobik.gen
BitDefender	Trojan.GenericKD.36405296
NANO-Antivirus	Trojan.Win32.Bobik.impnnt
Paloalto	generic.ml
AegisLab	Trojan.Win32.Bobik.l!c
Rising	Backdoor.Molerats!1.D32D (CLOUD)
Ad-Aware	Trojan.GenericKD.36405296
Sophos	Mal/Generic-S
Comodo	Malware@#1h51v5zzgg9th
DrWeb	Trojan.Siggen12.18374
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.MOLERAT.A
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
FireEye	Generic.mg.7833c0f413c1611f
Emsisoft	Trojan.GenericKD.36405296 (B)
Jiangmin	TrojanSpy.Bobik.oq
MaxSecure	Trojan.Malware.74196578.susgen
Avira	TR/ATRAPS.Gen
MAX	malware (ai score=99)
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Gen.oa
Microsoft	Trojan:Win32/Ymacco.AAC9
GData	Trojan.GenericKD.36405296
ALYac	Trojan.MSIL.Bobik
VBA32	TScope.Trojan.Delf
Cylance	Unsafe
TrendMicro-HouseCall	TrojanSpy.Win32.MOLERAT.A
Yandex	TrojanSpy.Delf!L7ls1PE/PJw
Ikarus	Trojan.Agent
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
Cybereason	malicious.413c16

Questions about the study of freedoms 78639846 docx.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All