popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

invoice attachment.docm

VBA_macro Word 2007 file format(docx) AntiDebug AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 23, 2021, 6:56 p.m. Sept. 23, 2021, 6:58 p.m.
Size 188.7KB
Type Microsoft Word 2007+
MD5 4e3fe2ad8dc94dbf82847aa9c18e7efd
SHA256 712fd163cc98f8fb2055573336c606f17c66a22276dce9f6e9f909e3d6d23f16
CRC32 73C38939
ssdeep 3072:3NR4/YH4EAk1JEn5r2RvF1R/g+4lYLM6nxIJ4bImhO8jNCSqVbUoB/wqui:dQYHF+n5aNFf/g+4YnxE4e8qpUoiDi
Yara
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]
  • docx - Word 2007 file format detection

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
172.83.155.147 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75176d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75176de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75176e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7755011a
DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x7519cf5c
SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x751cf73c
SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x751cfa18
MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x751cfb1f
New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x742a77b7
MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x751cfd15
MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x751cfd57
rundll32+0x393f @ 0xe8393f
rundll32+0x247a @ 0xe8247a
rundll32+0x1baf @ 0xe81baf
rundll32+0x12e8 @ 0xe812e8
rundll32+0x1901 @ 0xe81901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x6ada3f46
registers.esp: 2747992
registers.edi: 0
registers.eax: 1792687942
registers.ebp: 2748032
registers.edx: 0
registers.ebx: 0
registers.esi: 1792687942
registers.ecx: 8916328
1 0 0

__exception__

 stacktrace: 
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75176d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75176de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75176e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7755011a
DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x7519cf5c
SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x751cf73c
SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x751cfa18
MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x751cfb1f
New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x742a77b7
MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x751cfd15
MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x751cfd57
rundll32+0x393f @ 0xe8393f
rundll32+0x247a @ 0xe8247a
rundll32+0x1baf @ 0xe81baf
rundll32+0x12e8 @ 0xe812e8
rundll32+0x1901 @ 0xe81901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x6ada3f46
registers.esp: 2747992
registers.edi: 0
registers.eax: 1792687942
registers.ebp: 2748032
registers.edx: 0
registers.ebx: 0
registers.esi: 1792687942
registers.ecx: 8916328
1 0 0

__exception__

 stacktrace: 
CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x74d1d08c
TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x74d1964b
TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x74d04d6b
TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x74d06f7c
CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x74d0e825
TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x74d06002
TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x74d05fe8
TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x74d049e3
TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x74d05a20
RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77579a91
LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77598f10
RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77598e5c
ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x76377a25
rundll32+0x135c @ 0xe8135c
rundll32+0x1901 @ 0xe81901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25
exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4
exception.instruction: call dword ptr [ecx + 0xc]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 278260
exception.address: 0x74d33ef4
registers.esp: 2750636
registers.edi: 0
registers.eax: 12656904
registers.ebp: 2750664
registers.edx: 1
registers.ebx: 0
registers.esi: 6562704
registers.ecx: 1792554364
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6a46e000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c69000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c69000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c69000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c69000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c69000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c69000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6ad31000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\~$voice attachment.docm
file C:\Users\test22\AppData\Local\fijxgr1chfv6js.vbs
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000490
filepath: C:\Users\test22\AppData\Local\Temp\~$voice attachment.docm
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$voice attachment.docm
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: rundll32.exe
parameters: C:\Users\test22\AppData\Local\rad7864D.tmp.dll,runquery
filepath: rundll32.exe
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef70000
process_handle: 0xffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 172.83.155.147
parent_process winword.exe martian_process "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\fijxgr1chfv6js.vbs"
parent_process wscript.exe martian_process "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\rad7864D.tmp.dll,runquery
parent_process wscript.exe martian_process rundll32.exe C:\Users\test22\AppData\Local\rad7864D.tmp.dll,runquery
Process injection Process 2488 resumed a thread in remote process 292
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000678
suspend_count: 1
process_identifier: 292
1 0 0
Elastic malicious (high confidence)
Sangfor Malware.Generic-VBA.Save.Obfuscated
BitDefender Trojan.GenericKD.37627980
Cyren PP97M/Agent.gen
ESET-NOD32 a variant of VBA/TrojanDropper.Agent.CEX
TrendMicro-HouseCall Trojan.W97M.TRICKBOT.YXBIWZ
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba TrojanDownloader:VBA/MalDoc.ali1000101
MicroWorld-eScan Trojan.GenericKD.37627980
Ad-Aware Trojan.GenericKD.37627980
McAfee-GW-Edition BehavesLike.Downloader.cc
FireEye Trojan.GenericKD.37627980
Ikarus Win32.SuspectCrc
GData Trojan.GenericKD.37627980
MAX malware (ai score=81)
Microsoft TrojanDownloader:O97M/TrickBot.SS!MTB
ZoneAlarm HEUR:Trojan-Dropper.MSOffice.SDrop.gen
McAfee RDN/Sadoca
SentinelOne Static AI - Malicious OPENXML
Fortinet VBA/Agent.CEX!tr
dead_host 172.83.155.147:80
file C:\Windows\SysWOW64\wscript.exe
file C:\Windows\System32\rundll32.exe