popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Auszahlungen.xls

VBA_macro Generic Malware MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 15, 2021, 1:50 p.m. Oct. 15, 2021, 1:52 p.m.
Size 108.5KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Yhnxx, Last Saved By: X112, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Oct 8 09:36:50 2021, Last Saved Time/Date: Thu Oct 14 03:27:39 2021, Security: 0
MD5 413bd16983ee371d2955416354a17b2c
SHA256 5457145d1709f6828a743ebe4ab34c74345647d7caca86d715db1cb52a7c596e
CRC32 26164F9E
ssdeep 3072:vdcKoSsxzNDZL2Qiw+4868O8KKA4Rdbwrk3hbdlylKsgqopeJBWhZFGkE+cL4Lxp:FcKoSsxzNDZL2Qiw+4868O8KKA4Rdbw/
Yara
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]
  • Generic_Malware_Zero - Generic Malware
  • Microsoft_Office_File_Zero - Microsoft Office File

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
23.19.58.52 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6bf98000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6bc8e000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0059a000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0059a000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b822000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef70000
process_handle: 0xffffffff
1 0 0
host 23.19.58.52
McAfee RDN/Generic
ESET-NOD32 a variant of Generik.FAHIFDW
Kaspersky HEUR:Trojan-Downloader.MSOffice.SLoad.gen
BitDefender Trojan.GenericKD.37800096
MicroWorld-eScan Trojan.GenericKD.37800096
Ad-Aware Trojan.GenericKD.37800096
McAfee-GW-Edition Artemis!Trojan
FireEye Trojan.GenericKD.37800096
Sophos Troj/DocDrp-AFZ
Ikarus Win32.Outbreak
GData Trojan.GenericKD.37800096
MAX malware (ai score=82)
ZoneAlarm HEUR:Trojan-Downloader.MSOffice.SLoad.gen
Microsoft TrojanDownloader:O97M/EncDoc.AL!MTB
dead_host 23.19.58.52:80