popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cyto.dotm

VBA_macro Antivirus Word 2007 file format(docx)
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 23, 2021, 8:45 a.m. Sept. 23, 2021, 8:48 a.m.
Size 18.0KB
Type Microsoft Word 2007+
MD5 42d3a33135b372220211d217a62ffe95
SHA256 9a6fae61e5af913a5df90d06d4b1eeda3a5be4d82f588d55d38c973a3448981e
CRC32 81C517A6
ssdeep 384:t9+JtkvD5TLtGqpNQCNxt/ZtNNOUSx+30OnRPQ:X+7S+2xllNMx+3BRo
Yara
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]
  • docx - Word 2007 file format detection

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007fa000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007fa000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007fa000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007fa000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007fa000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007fa000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x69ca4000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\~$cyto.dotm
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cms.bat
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x0000045c
filepath: C:\Users\test22\AppData\Local\Temp\~$cyto.dotm
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$cyto.dotm
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cms.bat
Elastic malicious (high confidence)
MicroWorld-eScan VB.Heur2.PwShell.2.681B6867.Gen
FireEye VB.Heur2.PwShell.2.681B6867.Gen
Sangfor Trojan.Macro.PowerShell.se
Symantec ISB.Dropper!gen4
ClamAV Doc.Dropper.Agent-6412232-1
BitDefender VB.Heur2.PwShell.2.681B6867.Gen
Tencent Heur.Macro.Generic.a.614b2cae
Ad-Aware VB.Heur2.PwShell.2.681B6867.Gen
Emsisoft VB.Heur2.PwShell.2.681B6867.Gen (B)
ZoneAlarm HEUR:Trojan-Downloader.Script.Generic
GData VB.Heur2.PwShell.2.681B6867.Gen
MAX malware (ai score=80)
Rising Heur.Macro.powershell.a (CLASSIC)
SentinelOne Static AI - Suspicious OPENXML