popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

0722_7087881301.xls

VBA_macro Generic Malware Malicious Library ScreenShot KeyLogger AntiDebug MSOffice File AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 23, 2021, 9:20 a.m. July 23, 2021, 9:31 a.m.
Size 343.0KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Create Time/Date: Fri Jun 5 18:17:20 2015, Last Saved Time/Date: Thu Jul 22 10:34:23 2021, Security: 0
MD5 1a78008b2f07c1a067c4d84fcc63c413
SHA256 47579616cf87056ba3ef9e57881d5cb56dc31938938a368901d7524b45d71ebe
CRC32 C0A1DF58
ssdeep 6144:DMZJUzBZaf84VE4l/ML5xEop3fduk3hOdsylKlgxopeiBNhZF+E+W2kdAzvvvvv8:yAO84VE4l/MLzEglkfPEDvL3
Yara
  • Generic_Malware_Zero - Generic Malware
  • Microsoft_Office_File_Zero - Microsoft Office File
  • Malicious_Library_Zero - Malicious_Library
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2084
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b617000
process_handle: 0xffffffff
1 0 0
description Run a KeyLogger rule KeyLogger
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
Elastic malicious (high confidence)
MicroWorld-eScan VB:Trojan.Valyria.5086
K7AntiVirus Trojan ( 00563a341 )
K7GW Trojan ( 00563a341 )
Kaspersky HEUR:Trojan-Dropper.Script.Generic
BitDefender VB:Trojan.Valyria.5086
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
Ad-Aware VB:Trojan.Valyria.5086
TACHYON Suspicious/W97.NS.Gen
TrendMicro HEUR_VBA.DE
FireEye VB:Trojan.Valyria.5086
Emsisoft VB:Trojan.Valyria.5086 (B)
GData VB:Trojan.Valyria.5086
Antiy-AVL Trojan/Generic.ASDOH.5A
ZoneAlarm HEUR:Trojan-Dropper.Script.Generic
Microsoft Trojan:Script/Wacatac.B!ml
MAX malware (ai score=89)
Fortinet VBA/Agent.1371!tr
parent_process excel.exe martian_process "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /Embedding
Process injection Process 2084 resumed a thread in remote process 2192
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000460
suspend_count: 1
process_identifier: 2192
1 0 0