popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Invoice_730621.xls

Dridex VBA_macro MSOffice File PE File DLL PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 22, 2021, 11:06 a.m. July 22, 2021, 11:11 a.m.
Size 371.5KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Invoice_730621, Author: Quickbooks, LLC, Last Saved By: user, Name of Creating Application: Microsoft Excel, Last Printed: Thu Jul 26 12:08:13 2018, Create Time/Date: Thu Jul 26 00:26:51 2018, Last Saved Time/Date: Wed Jul 21 11:45:25 2021, Security: 0
MD5 15d1252024d046b76737f80017b31b5e
SHA256 4a8c152ef7c7e3ced93e8629691f6f66bb67f78c4e17caf0198db18300b19acf
CRC32 2F44D4E2
ssdeep 6144:N0Y35qAOJl/YrLYz+WrNhZF+E+W2RGtpPjKBbA2G0VeU+fMGM9yhy1Ck/ug14z:GjwbA2EfK3
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]

Name Response Post-Analysis Lookup
taskremindment.com
A 128.199.243.169
A 208.83.69.35
128.199.243.169
IP Address Status Action
128.199.243.169 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 128.199.243.169:8088 -> 192.168.56.103:49165 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c1e8000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6bede000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05eec000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05eec000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6bc22000
process_handle: 0xffffffff
1 0 0
file C:\ProgramData\qRangeAutoFormatTable1.dll
cmdline mshta C:\ProgramData//klDialogDeleteFormat.sct
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef70000
process_handle: 0xffffffff
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan VBA.Heur2.Dridex.4.19CF1996.Gen
FireEye VBA.Heur2.Dridex.4.19CF1996.Gen
Kaspersky UDS:Exploit.MSOffice.CVE-2017-8570.gen
BitDefender VBA.Heur2.Dridex.4.19CF1996.Gen
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
Ad-Aware VBA.Heur2.Dridex.4.19CF1996.Gen
Emsisoft VBA.Heur2.Dridex.4.19CF1996.Gen (B)
TrendMicro HEUR_VBA.O2
McAfee-GW-Edition BehavesLike.OLE2.Downloader.fg
GData VBA.Heur2.Dridex.4.19CF1996.Gen
ALYac VBA.Heur2.Dridex.4.19CF1996.Gen
MAX malware (ai score=88)
Zoner Probably Heur.W97ShellB
Qihoo-360 virus.office.obfuscated.1
parent_process excel.exe martian_process mshta C:\ProgramData//klDialogDeleteFormat.sct