popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

navitas_employee_survey.hta

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 22, 2021, 10:05 p.m. Sept. 22, 2021, 10:26 p.m.
Size 20.9KB
Type HTML document, ASCII text
MD5 537363b3738a8e0726ae15e6bc4fc314
SHA256 189f65faae56bbf7a53e507d8797c9bb30f8c00fdb8431ad1961820cebabbd03
CRC32 A9B0A80F
ssdeep 192:fgVwLjUJpJf0t59KLKnV45J22j9SomaWXO:YVwLjmpJfC59KLKnV45J22j9SomaWXO
Yara None matched

Name Response Post-Analysis Lookup
www.healthsouthdothan.com
A 13.59.208.38
CNAME healthsouthdothan.com
13.59.208.38
IP Address Status Action
13.59.208.38 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET http://www.healthsouthdothan.com/components/tab_home.ico
request GET http://www.healthsouthdothan.com/tab_home_active
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2024
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73fc2000
process_handle: 0xffffffff
1 0 0
DrWeb MACRO.Virus
MicroWorld-eScan VB:Trojan.Valyria.481
FireEye VB:Trojan.Valyria.481
CAT-QuickHeal VBS.Trojan.Script.38976
McAfee HTML/Injector.a
Symantec Trojan.Malscript
ESET-NOD32 Win32/Rozena.XZ
Avast VBS:Agent-BTN [Trj]
ClamAV Html.Trojan.CobaltStrike-7932564-0
Kaspersky Trojan.VBS.MacroDisable.b
BitDefender VB:Trojan.Valyria.481
NANO-Antivirus Trojan.Script.Vbs-heuristic.druvzi
Rising HackTool.MacroRunner/VBS!1.D1CA (CLASSIC)
Ad-Aware VB:Trojan.Valyria.481
Emsisoft VB:Trojan.Valyria.481 (B)
McAfee-GW-Edition BehavesLike.HTML.Backdoor.mr
Sophos ATK/VBSInj-C
MAX malware (ai score=83)
Microsoft Trojan:VBS/Valyria.A!MSR
GData VB:Trojan.Valyria.481
ALYac VB:Trojan.Valyria.481
Tencent Html.Win32.Script.504167
Ikarus Trojan.VB.Valyria
Fortinet VBS/Rozena.XZ!tr
AVG VBS:Agent-BTN [Trj]