popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

diagram-116.doc

VBA_macro Generic Malware MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 17, 2021, 11:06 a.m. Sept. 17, 2021, 11:08 a.m.
Size 277.0KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: x, Template: Normal.dotm, Last Saved By: x, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Sep 16 09:44:00 2021, Last Saved Time/Date: Thu Sep 16 09:44:00 2021, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
MD5 ed7013efeb9d004aba9b9a5daa757261
SHA256 dbff183aaaf16de7414a76cae3642a33fd8fc95f97fef3b82f0472cb766bf7b8
CRC32 25FB4184
ssdeep 3072:OWx4E8St67hXqGbaNRsqYr6ZCz1xNYm9qhWmmyKyEw9u9qLF0EYouFCoOVagZ7:nxLHtyhvba8qYroThW9yZEJoEou4Z7
Yara
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]
  • Generic_Malware_Zero - Generic Malware
  • Microsoft_Office_File_Zero - Microsoft Office File

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        8b 4f 14 e8 ab ce 02 00 85 c0 0f 84 9c 7e 0d 00
        

      
        exception.instruction:
        mov ecx, dword ptr [edi + 0x14]
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.symbol:
        VarPtr+0x1eac3 rtcBstrFromFormatVar-0x1e541 vbe7+0x30e97
        

      
        exception.address:
        0x69e50e97
        

      
    
  
    
      
        registers.esp:
        4422260
        

      
        registers.edi:
        0
        

      
        registers.eax:
        0
        

      
        registers.ebp:
        4422400
        

      
        registers.edx:
        302124579
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2088
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x69ff1000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2088
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          1
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x004e7000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2088
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          1
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x004e7000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2088
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          1
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x004e9000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Application Crash
                                    Process WINWORD.EXE with pid 2088 crashed
                                    
                                


                            

                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        8b 4f 14 e8 ab ce 02 00 85 c0 0f 84 9c 7e 0d 00
        

      
        exception.instruction:
        mov ecx, dword ptr [edi + 0x14]
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.symbol:
        VarPtr+0x1eac3 rtcBstrFromFormatVar-0x1e541 vbe7+0x30e97
        

      
        exception.address:
        0x69e50e97
        

      
    
  
    
      
        registers.esp:
        4422260
        

      
        registers.edi:
        0
        

      
        registers.eax:
        0
        

      
        registers.ebp:
        4422400
        

      
        registers.edx:
        302124579
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    file
                                    C:\Users\test22\AppData\Local\Temp\~$agram-116.doc
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtCreateFile

  
  
    
      
    
  


  
    
      create_disposition:
      
        
          5
        
      
      
        (FILE_OVERWRITE_IF)
      
      

    
  
    
      file_handle:
      
        
          0x0000046c
        
      
      
      

    
  
    
      filepath:
      
        
          C:\Users\test22\AppData\Local\Temp\~$agram-116.doc
        
      
      
      

    
  
    
      desired_access:
      
        
          0x40100080
        
      
      
        (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
      
      

    
  
    
      file_attributes:
      
        
          2
        
      
      
        (FILE_ATTRIBUTE_HIDDEN)
      
      

    
  
    
      filepath_r:
      
        
          \??\C:\Users\test22\AppData\Local\Temp\~$agram-116.doc
        
      
      
      

    
  
    
      create_options:
      
        
          4194400
        
      
      
        (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
      
      

    
  
    
      status_info:
      
        
          2
        
      
      
        (FILE_CREATED)
      
      

    
  
    
      share_access:
      
        
          0
        
      
      
        ()
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                            parent_process
                                            winword.exe
                                        
                                    
                                        
                                    
                                        
                                            martian_process
                                            "C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1464