Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 26, 2021, 3:02 p.m.	Oct. 26, 2021, 3:05 p.m.

Size	56.0KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Create Time/Date: Mon Oct 25 07:52:46 2021, Last Saved Time/Date: Mon Oct 25 07:52:48 2021, Security: 0, Author: DHL eCommerce
MD5	`2172d539dfc31f78f87363c9837fc788`
SHA256	`7116c93e85891626185692c325a7c648bf2f2effb5c05582f77a18144b620164`
CRC32	`D8DDA55B`
ssdeep	`1536:GsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0w05bQK/64f6xMmsi0wW6l:GhlYkEIuPm3fNRZmbaoFhZhR0cixIHmp`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries] Generic_Malware_Zero - Generic Malware Microsoft_Office_File_Zero - Microsoft Office File

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\DHL-Fattura-446732-9302.xls
1224

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 26, 2021, 3:02 p.m.	process_identifier: 1224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dce1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 26, 2021, 3:02 p.m.	process_identifier: 1224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dd3f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 26, 2021, 3:02 p.m.	process_identifier: 1224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dd3f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 26, 2021, 3:02 p.m.	process_identifier: 1224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dc81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 26, 2021, 3:02 p.m.	process_identifier: 1224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 26, 2021, 3:02 p.m.	process_identifier: 1224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dbc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 26, 2021, 3:02 p.m.	process_identifier: 1224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dbc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 26, 2021, 3:02 p.m.	process_identifier: 1224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 26, 2021, 3:02 p.m.	process_identifier: 1224 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05de0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 26, 2021, 3:02 p.m.	process_identifier: 1224 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05de0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 26, 2021, 3:02 p.m.	process_identifier: 1224 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05df0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 26, 2021, 3:02 p.m.	process_identifier: 1224 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Lionic	Trojan.Script.Generic.4!c
MicroWorld-eScan	Trojan.GenericKD.37867439
McAfee	X97M/Downloader.ic
Sangfor	Malware.Generic-VBA.Save.Obfuscated
Cyren	X97M/Agent.ABU.gen!Eldorado
Symantec	Trojan.Mdropper
ESET-NOD32	VBA/TrojanDownloader.Agent.WXC
TrendMicro-HouseCall	TROJ_FRS.VSNTJP21
Avast	Other:Malware-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.37867439
Ad-Aware	Trojan.GenericKD.37867439
Emsisoft	Trojan.GenericKD.37867439 (B)
TrendMicro	TROJ_FRS.VSNTJP21
McAfee-GW-Edition	X97M/Downloader.ic
FireEye	Trojan.GenericKD.37867439
Microsoft	TrojanDownloader:O97M/Ursnif.ARJ!MTB
ZoneAlarm	HEUR:Trojan.Script.Generic
GData	Generic.Trojan.Agent.BHAUY7
MAX	malware (ai score=87)
Ikarus	Trojan.VBA.Agent
Fortinet	VBA/Agent.WPW!tr
AVG	Other:Malware-gen [Trj]

DHL-Fattura-446732-9302.xls

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All