Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.18 09:11
babababa.exe
11.18 09:11
Jagtfalkenes.vbs
11.18 09:11
windows_update.dll
11.18 09:11
nicko.exe
11.18 09:11
GHO%E9%95%9C%E5%83%8F%...
11.18 09:11
stories.exe
11.17 10:11
wwbizsrvs.exe
11.15 01:11
wwbizsrvs.exe
11.15 01:11
op.exe
11.15 01:11
msf.exe

Latest News
11.18 01:11
에듀피디, ‘알기 쉽게 풀어쓴 산업위생관...
11.18 12:11
KISA, 사이버보안 인재 양성 프로젝트...
11.18 12:11
Completing the UE1’s P...
11.18 12:11
ISC Stormcast For Mond...
11.18 12:11
IT Sicherheitsnews stü...
11.18 11:11
Report on DDoSia Malwa...
11.18 11:11
전통 공예의 새로운 접근, 'M-ART(...
11.18 11:11
Die Schattenseiten des...
11.18 10:11
호텔식 샤브샤브 뷔페 '샤브올데이', 동...
11.18 10:11
창원 노인주간보호센터 '수주간보호센터 창...

Summary | ZeroBOX

Employee%20Update%20-%20Covid.xls

VBA_macro Generic Malware MSOffice File

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 8, 2021, 8:14 a.m.	Oct. 8, 2021, 8:16 a.m.

Size	68.5KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Ferop, Last Saved By: X112, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Aug 17 12:24:08 2021, Last Saved Time/Date: Thu Oct 7 12:04:36 2021, Security: 0
MD5	`bb6169cac9a125cd63eedeb3893b920b`
SHA256	`2acdd04554feb1ef8b0307d5fb2c1bf7fd6a8e1157f9d3753119e64b30c16c30`
CRC32	`74F12D64`
ssdeep	`1536:zScKoSsxz1PDZL2Qiw+4868O8K/5Le+k3hbdlylKsgqopeJBWhZFGkE+cL2NdAPy:zScKoSsxzNDZL2Qiw+4868O8K/5Le+kC`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries] Generic_Malware_Zero - Generic Malware Microsoft_Office_File_Zero - Microsoft Office File

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\Employee%20Update%20-%20Covid.xls
2216

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.176.220.198	Active	Moloch
185.225.19.246	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://185.225.19.246/

Performs some HTTP requests (1 event)

request

GET http://185.225.19.246/

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dce1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dd3f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dd3f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dc81000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65001000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dba1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6db81000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6de21000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6d7c1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6d7c1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6da01000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

File has been identified by 4 AntiVirus engines on VirusTotal as malicious (4 events)

McAfee	RDN/GenericM
Symantec	Trojan.Mdropper
Kaspersky	UDS:Trojan-Downloader.MSOffice.SLoad.gen
McAfee-GW-Edition	Artemis!Trojan

Communicates with host for which no DNS query was performed (2 events)

host	185.176.220.198
host	185.225.19.246

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.176.220.198:80