popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

allocate.dot

VBA_macro MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 12, 2021, 9:46 a.m. July 12, 2021, 9:53 a.m.
Size 161.5KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Template: 26412, Last Saved By: Windows, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Sun Jul 11 18:34:00 2021, Last Saved Time/Date: Sun Jul 11 18:34:00 2021, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0
MD5 c7810b25c8edd6269c92af482560e600
SHA256 0f9d723c3023a6af3e5522f63f649c7d6a8cb2727ec092e0b38ee76cd1bbf1c4
CRC32 142D7A12
ssdeep 1536:3l/jXBM8Z/JvH4wm+oDkC01YNWSmAEW51MpWZemUE7mGc0pXu474eODdz9jgUGpG:3lry2qezHG/+6w9qiSQLFUda
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Statement CallByName lxvfIunfHrQbCFmUtfmVryw, pQncyAsOEwuwMUATFA, VbMethod, wpjGvqtcHMMEmBMqr, 0, False
Statement CallByName nWOsVeIPkmBEiWbmYuq, sSZamgTM, 1, HlwMLGUxcZfpOuMGV, wtjgOlyXTVPapVUQwtzHU, 6, , , 3
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x65001000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732d1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x058d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x058d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x058e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x058f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c951000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c954000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x507c1000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000198
filepath: C:\Users\test22\AppData\Local\Temp\~$locate.dot
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$locate.dot
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
Elastic malicious (high confidence)
ALYac VBA:Amphitryon.1918
Sangfor Malware.Generic-VBA.Save.Obfuscated
Arcabit VBA:Amphitryon.D77E
Kaspersky HEUR:Trojan-Dropper.Script.Generic
BitDefender VBA:Amphitryon.1918
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
MicroWorld-eScan VBA:Amphitryon.1918
Rising Downloader.Agent/VBA!1.ADB3 (CLASSIC)
Ad-Aware VBA:Amphitryon.1918
Emsisoft VBA:Amphitryon.1918 (B)
McAfee-GW-Edition BehavesLike.OLE2.Downloader.cl
FireEye VBA:Amphitryon.1918
GData VBA:Amphitryon.1918
TACHYON Suspicious/W97M.Obfus.Gen.1
MAX malware (ai score=81)
Zoner Probably Heur.W97Obfuscated
Tencent Heur.Macro.Generic.h.77db8a84
SentinelOne Static AI - Malicious OLE
Qihoo-360 virus.office.qexvmc.1075