popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1019_7169909343268.doc

VBA_macro Generic Malware MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 20, 2021, 3:17 p.m. Oct. 20, 2021, 3:19 p.m.
Size 534.5KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: kell, Template: Normal, Last Saved By: kell, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Oct 19 14:09:00 2021, Last Saved Time/Date: Tue Oct 19 14:09:00 2021, Number of Pages: 1, Number of Words: 3, Number of Characters: 19, Security: 0
MD5 4e062eb96bf086392a2a33f0f2dd7e69
SHA256 29c4d9f88f26a2a929b980571cdabab0185bdc0b926fd1dd9fb38489ba6a4306
CRC32 F3360BEB
ssdeep 12288:o8CmEKY7gpWMBueoM6scG2u302l0HwbsG7kWunEDXm/zjH0Bk:o8CmEj6BuTMDn2u3049HSn+Xm/v
Yara
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]
  • Generic_Malware_Zero - Generic Malware
  • Microsoft_Office_File_Zero - Microsoft Office File

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x65001000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c9b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6ca05000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c9a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c971000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c851000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c4f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c4f4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c761000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 872
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x07660000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 872
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x07660000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 872
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x07670000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 872
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x07680000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x507c1000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\~$19_7169909343268.doc
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000198
filepath: C:\Users\test22\AppData\Local\Temp\~$19_7169909343268.doc
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$19_7169909343268.doc
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
cve CVE-2013-3906
ALYac VB:Trojan.Valyria.5322
Arcabit VB:Trojan.Valyria.D14CA
Cyren W97M/Agent.ABS.gen!Eldorado
ESET-NOD32 VBA/TrojanDropper.Agent.CEY
Avast Script:SNH-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan-Dropper.Script.Generic
BitDefender VB:Trojan.Valyria.5322
MicroWorld-eScan VB:Trojan.Valyria.5322
Ad-Aware VB:Trojan.Valyria.5322
Emsisoft VB:Trojan.Valyria.5322 (B)
F-Secure Heuristic.HEUR/Macro.Downloader.MRAHJ.Gen
VIPRE LooksLike.Macro.Malware.k (v)
McAfee-GW-Edition W97M/Dropper.ik
FireEye VB:Trojan.Valyria.5322
Ikarus Trojan-Dropper.VBA.Agent
Avira HEUR/Macro.Downloader.MRAHJ.Gen
Antiy-AVL Trojan/Generic.ASMacro.2D970
ZoneAlarm HEUR:Trojan-Dropper.Script.Generic
GData VB:Trojan.Valyria.5322
McAfee W97M/Dropper.ik
MAX malware (ai score=81)
Zoner Probably Heur.W97Obfuscated
Fortinet VBA/Agent.CEY!tr
AVG Script:SNH-gen [Trj]