Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.18 02:11
DOCTOR FIRM ORDER FORM...
11.18 09:11
babababa.exe
11.18 09:11
Jagtfalkenes.vbs
11.18 09:11
windows_update.dll
11.18 09:11
nicko.exe
11.18 09:11
GHO%E9%95%9C%E5%83%8F%...
11.18 09:11
stories.exe
11.17 10:11
wwbizsrvs.exe
11.15 01:11
wwbizsrvs.exe
11.15 01:11
op.exe

Latest News
11.18 04:11
Exploit attempts for u...
11.18 04:11
NSO Group Exploited Wh...
11.18 03:11
대한민국 전통가마 연구소 ‘태고사’ 20...
11.18 03:11
더 청담, '2024 전통문화혁신사업 수...
11.18 03:11
동방이기제작소, '2024 전통문화혁신사...
11.18 03:11
디저트39, 필리핀·미국에 이어 몽골 진출
11.18 03:11
Beyoncé to Join Netfli...
11.18 03:11
에스엠해썹, 2024 스마트공장 지원사업...
11.18 03:11
삼진벽난로, 알펜시아 에스테이트 초프리미...
11.18 03:11
Analog Shift Register ...

Summary | ZeroBOX

Employee%20Update%20-%20Covid.xls

VBA_macro Generic Malware MSOffice File

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 8, 2021, 8:14 a.m.	Oct. 8, 2021, 8:16 a.m.

Size	68.5KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Ferop, Last Saved By: X112, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Aug 17 12:24:08 2021, Last Saved Time/Date: Thu Oct 7 12:04:36 2021, Security: 0
MD5	`bb6169cac9a125cd63eedeb3893b920b`
SHA256	`2acdd04554feb1ef8b0307d5fb2c1bf7fd6a8e1157f9d3753119e64b30c16c30`
CRC32	`74F12D64`
ssdeep	`1536:zScKoSsxz1PDZL2Qiw+4868O8K/5Le+k3hbdlylKsgqopeJBWhZFGkE+cL2NdAPy:zScKoSsxzNDZL2Qiw+4868O8K/5Le+kC`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries] Generic_Malware_Zero - Generic Malware Microsoft_Office_File_Zero - Microsoft Office File

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\Employee%20Update%20-%20Covid.xls
2216

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.176.220.198	Active	Moloch
185.225.19.246	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://185.225.19.246/

Performs some HTTP requests (1 event)

request

GET http://185.225.19.246/

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dce1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dd3f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dd3f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dc81000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65001000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dba1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6db81000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6de21000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6d7c1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6d7c1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6da01000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 8, 2021, 8:14 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

File has been identified by 4 AntiVirus engines on VirusTotal as malicious (4 events)

McAfee	RDN/GenericM
Symantec	Trojan.Mdropper
Kaspersky	UDS:Trojan-Downloader.MSOffice.SLoad.gen
McAfee-GW-Edition	Artemis!Trojan

Communicates with host for which no DNS query was performed (2 events)

host	185.176.220.198
host	185.225.19.246

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.176.220.198:80