popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Document%2076896654.xls

VBA_macro MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 17, 2021, 1:32 p.m. June 17, 2021, 1:34 p.m.
Size 215.5KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Title: uncategorisable outport, Subject: glovings disciples, Author: tuberoses parathyroidectomies, Last Saved By: user, Name of Creating Application: Microsoft Excel, Last Printed: Wed Apr 21 12:08:24 2010, Create Time/Date: Thu Apr 13 21:48:14 2000, Last Saved Time/Date: Wed Jun 16 11:46:04 2021, Security: 0
MD5 608d89a9afafdce353965d9ee16bd433
SHA256 192c127cfb5e8ba572cda74b035db1b7cceaff14b218bac1dfd75f8e85fca5b5
CRC32 9B0A4DFE
ssdeep 6144:dxEtjPOtioVjDGUU1qfDlavx+W2QnWxuXksb4dlBTNMO57imHK002LR+:Jj2MzqsLQ
Yara
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]
  • Microsoft_Office_File_Zero - Microsoft Office File

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49811 -> 162.253.125.64:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49815 -> 69.10.44.242:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 18.136.132.202:443 -> 192.168.56.102:49818 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 185.58.73.16:443 -> 192.168.56.102:49822 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49824 -> 104.255.169.179:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.102:49828 -> 144.91.77.124:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49824 -> 104.255.169.179:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.102:49824 -> 104.255.169.179:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49839 -> 51.68.175.88:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49829 -> 144.91.77.124:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 51.68.175.88:443 -> 192.168.56.102:49841 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49833 -> 18.136.132.202:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49840 -> 51.68.175.88:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49817 -> 18.136.132.202:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49821 -> 185.58.73.16:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 162.253.125.64:443 -> 192.168.56.102:49813 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49826 -> 104.255.169.179:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.102:49826 -> 104.255.169.179:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 104.255.169.179:443 -> 192.168.56.102:49826 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 104.255.169.179:443 -> 192.168.56.102:49826 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.102:49809 -> 191.252.138.153:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49820 -> 185.58.73.16:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49812 -> 162.253.125.64:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49816 -> 18.136.132.202:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49825 -> 104.255.169.179:443 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 192.168.56.102:49825 -> 104.255.169.179:443 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 192.168.56.102:49825 -> 104.255.169.179:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 104.255.169.179:443 -> 192.168.56.102:49825 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 104.255.169.179:443 -> 192.168.56.102:49825 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode
TCP 144.91.77.124:443 -> 192.168.56.102:49830 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49832 -> 18.136.132.202:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 18.136.132.202:443 -> 192.168.56.102:49834 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49836 -> 191.252.106.110:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 104.255.169.179:443 -> 192.168.56.102:49824 2230002 SURICATA TLS invalid record type Generic Protocol Command Decode
TCP 104.255.169.179:443 -> 192.168.56.102:49824 2230010 SURICATA TLS invalid record/traffic Generic Protocol Command Decode

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49815
69.10.44.242:443 		C=US, O=Let's Encrypt, CN=R3 CN=blog.bitz.pe 74:7c:eb:25:aa:dd:69:aa:be:8a:a5:ae:ae:a0:01:6d:ab:b4:45:47
TLSv1
192.168.56.102:49809
191.252.138.153:443 		C=US, ST=TX, L=Houston, O=cPanel, Inc., CN=cPanel, Inc. Certification Authority CN=arteecaligrafia.com.br 4d:e0:10:40:c9:d2:2b:64:f0:af:4e:e9:94:2e:64:b5:e3:db:cd:a8
TLSv1
192.168.56.102:49836
191.252.106.110:443 		C=US, ST=TX, L=Houston, O=cPanel, Inc., CN=cPanel, Inc. Certification Authority CN=sierraimoveis.com.br 21:c0:c7:7d:2f:02:3c:50:74:2b:66:fa:47:cb:3d:aa:c0:e9:64:9b

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x766fd08c
TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x766f964b
TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x766e4d6b
TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x766e6f7c
CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x766ee825
TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x766e6002
TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x766e5fe8
TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x766e49e3
TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x766e5a20
RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x773d9a91
LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x773f8f10
RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x773f8e5c
ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x75737a25
rundll32+0x135c @ 0xc135c
rundll32+0x1901 @ 0xc1901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25
exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4
exception.instruction: call dword ptr [ecx + 0xc]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 278260
exception.address: 0x76713ef4
registers.esp: 3143592
registers.edi: 0
registers.eax: 4032896
registers.ebp: 3143620
registers.edx: 1
registers.ebx: 0
registers.esi: 6867984
registers.ecx: 1915696604
1 0 0
request GET https://arteecaligrafia.com.br/imagens/fotos/thumbs/MupJ4cZzxoElmn.php
request GET https://blog.bitz.pe/wp-content/plugins/wpforms-lite/vendor/goodby/csv/src/Goodby/CSV/Import/Protocol/Exception/M7yde0cw.php
request GET https://sierraimoveis.com.br/manager/bower_components/bootstrap/less/mixins/BpZbPd8mY0.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70af1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70b4f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70b4f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73711000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05731000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73321000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71f61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71f71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e5e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x726d1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x66b71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x66bf1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x66bb1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x737f1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 7388
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x076b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 7388
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x076b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 7388
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x076c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 7388
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x07720000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
host 172.217.25.14
Elastic malicious (high confidence)
MicroWorld-eScan VB:Trojan.Valyria.4710
FireEye VB:Trojan.Valyria.4710
Cyren X97M/Agent.WF.gen!Eldorado
TrendMicro-HouseCall Possible_OLEMAL
BitDefender VB:Trojan.Valyria.4710
Ad-Aware VB:Trojan.Valyria.4710
Emsisoft VB:Trojan.Valyria.4710 (B)
VIPRE LooksLike.Macro.Malware.gen!x1 (v)
TrendMicro Possible_OLEMAL
McAfee-GW-Edition BehavesLike.OLE2.Downloader.db
SentinelOne Static AI - Malicious OLE
MAX malware (ai score=85)
Microsoft Trojan:Win32/Dridex!ml
GData VB:Trojan.Valyria.4710
ALYac VB:Trojan.Valyria.4710
Zoner Probably Heur.W97Obfuscated
Rising Malware.ObfusVBA@ML.100 (VBA)
Fortinet VBA/Agent.WCP!tr.dldr
com_class MSXML2.XMLHTTP May attempt to connect to the outside world
parent_process excel.exe martian_process "C:\Windows\System32\rundll32.exe" "C:\Users\test22\AppData\Roaming\26395.dll",StartW
payload_url https://arteecaligrafia.com.br/imagens/fotos/thumbs/MupJ4cZzxoElmn.php
file C:\Windows\System32\rundll32.exe