Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 30, 2021, 4:34 p.m.	Sept. 30, 2021, 4:36 p.m.

Size	8.6KB
Type	Zip archive data, at least v1.0 to extract
MD5	`02c2a68ce9a35f5f0e1b3456e09d6cc9`
SHA256	`34b53cd683f60800ac4057d25b24d8f083f759d024d22b4e5f2a464bc85de65a`
CRC32	`97947DA3`
ssdeep	`192:kq9XfpWycU3VyWYWCByCM0rzaGehWIgbKu5v4/A8jf:k0XfXCByirghWIsK+v4jjf`
Yara	docx - Word 2007 file format detection

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\34b53cd683f60800ac4057d25b24d8f083f759d024d22b4e5f2a464bc85de65a
112

Name	Response	Post-Analysis Lookup
maq.com.pk	A 203.124.43.227	203.124.43.227

IP Address	Status	Action
164.124.101.2	Active	Moloch
203.124.43.227	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Performs some HTTP requests (2 events)

request	OPTIONS http://maq.com.pk/
request	GET http://maq.com.pk/wehsd

Allocates read-write-execute memory (usually to unpack itself) (32 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cb01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6cae1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ca11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73321000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c9d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c9b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c961000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c901000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c8e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c7e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c8c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c6c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c6c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65001000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 4:34 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Sept. 30, 2021, 4:34 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000003ec filepath: C:\Users\test22\AppData\Local\Temp\~$b53cd683f60800ac4057d25b24d8f083f759d024d22b4e5f2a464bc85de65a desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$b53cd683f60800ac4057d25b24d8f083f759d024d22b4e5f2a464bc85de65a create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 events)

Lionic	Hacktool.MSOffice.CVE-2018-0802.3!c
MicroWorld-eScan	Trojan.Exploit.MSOfficeWord.GenericKDS.32375016
Alibaba	Exploit:Office/CVE-2018-0802.3ac7ac55
Symantec	Trojan.Mdropper
TrendMicro-HouseCall	TROJ_FRS.0NA103I319
Avast	Other:Malware-gen [Trj]
Kaspersky	HEUR:Exploit.MSOffice.CVE-2018-0802.gen
BitDefender	Trojan.Exploit.MSOfficeWord.GenericKDS.32375016
NANO-Antivirus	Exploit.Xml.CVE-2017-0199.equmby
Tencent	Office.Exploit.Cve-2018-0802.Fhy
Ad-Aware	Trojan.Exploit.MSOfficeWord.GenericKDS.32375016
Emsisoft	Trojan.Exploit.MSOfficeWord.GenericKDS.32375016 (B)
TrendMicro	TROJ_FRS.0NA103I319
McAfee-GW-Edition	Artemis!Trojan
FireEye	Trojan.Exploit.MSOfficeWord.GenericKDS.32375016
Ikarus	Exploit.CVE-2018-0802
GData	Trojan.Exploit.MSOfficeWord.GenericKDS.32375016
Antiy-AVL	Trojan[Exploit]/MSOffice.CVE-2018-0802
Microsoft	Exploit:O97M/CVE-2018-0802
Arcabit	Trojan.Exploit.MSOfficeWord.GenericS.D1EE00E8
ZoneAlarm	HEUR:Exploit.MSOffice.CVE-2018-0802.gen
ALYac	Exploit.CVE-2018-0802
MAX	malware (ai score=80)
Zoner	Probably Heur.W97OleLink
AVG	Other:Malware-gen [Trj]
Qihoo-360	Generic/Trojan.Exploit.efa

34b53cd683f60800ac4057d25b24d8f083f759d024d22b4e5f2a464bc85de65a

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All