Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 12, 2021, 9:41 a.m.	July 12, 2021, 9:44 a.m.

Size	1.4MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 936, Revision Number: {6DEA2D23-0F41-40EC-8ABE-DB484B9A6647}, Number of Words: 2, Subject: VKBjD, Author: VKBjD, Name of Creating Application: Advanced Installer 16.5 build 8df7ad95, Template: ;2052, Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
MD5	`b53accbf466304e55d3abdda94c1fe5d`
SHA256	`0e723f0f68b2800366b5abea9fa863ae89fc327c795bb8c60cf8fe087ebcf8b3`
CRC32	`77318F71`
ssdeep	`24576:L6uDXXNLj04BMeRocDP1NadWsvF4e1LpDhkPTG4Mcgiwkew8vroUQGDXDNSnf6Bv:L/Xdci5ooOWyLpFeBRSw8vlQIzNSnf6l`
Yara	Microsoft_Office_File_Zero - Microsoft Office File

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\08388e25.png.doc
2020

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.14.31.80	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (39 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb26000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb0b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb17000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6caf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cafb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6caf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6caf6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb3b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cad1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cad7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb1b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cae1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb10000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb3b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1000c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb26000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb0b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb17000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6caf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cafb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6caf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6caf6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb3b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cad1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cad7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 12, 2021, 9:41 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb1b000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\~$388e25.png.doc
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0001.doc
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0000.doc

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile July 12, 2021, 9:41 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000378 filepath: C:\Users\test22\AppData\Local\Temp\~$388e25.png.doc desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$388e25.png.doc create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

185.14.31.80

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.56.101:49208

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Lionic	Trojan.Win32.Agentb.4!c
MicroWorld-eScan	Trojan.GenericKD.37141378
FireEye	Trojan.GenericKD.37141378
CAT-QuickHeal	Trojan.Agentb
McAfee	RDN/Generic.com
Zillya	Trojan.Convagent.Win32.3606
Sangfor	Trojan.Win32.Save.a
Cyren	W32/Trojan.ESOV-9193
Symantec	Trojan.Gen.MBT
ESET-NOD32	multiple detections
TrendMicro-HouseCall	TrojanSpy.Win64.NOON.UHBAZCLOC
Avast	Other:Malware-gen [Trj]
ClamAV	Win.Trojan.Bulz-9863763-0
Kaspersky	Trojan.Win32.Agentb.kkyd
BitDefender	Trojan.GenericKD.37141378
NANO-Antivirus	Trojan.Win32.Black.ivcpha
Rising	Trojan.PurpleFox/MSI!1.D10D (CLASSIC)
Ad-Aware	Trojan.GenericKD.37141378
Sophos	Generic PUA BA (PUA)
Comodo	Malware@#t0l7i17zf0gb
DrWeb	Trojan.Packed2.43111
TrendMicro	TROJ_GEN.R002C0PFG21
McAfee-GW-Edition	RDN/Generic.grp
Emsisoft	Trojan.GenericKD.37141378 (B)
Ikarus	Trojan.Win32.VMProtect
Avira	TR/VB.Agent.rdoco
Antiy-AVL	Trojan/Generic.ASMalwS.32EA3E1
Kingsoft	Win32.Troj.Generic.a.(kcloud)
Gridinsoft	Trojan.U.Agent.oa
Microsoft	Trojan:Win32/Tiggre!rfn
GData	Script.Trojan.PurpleFox.D
Cynet	Malicious (score: 99)
BitDefenderTheta	Gen:NN.ZedlaF.34790.rG4@aWpFvhd
ALYac	Trojan.GenericKD.37141378
MAX	malware (ai score=81)
VBA32	TScope.Malware-Cryptor.SB
Tencent	Trojan.Win32.Agentb.wye
Fortinet	W32/PossibleThreat
AVG	Other:Malware-gen [Trj]

08388e25.png.doc

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All