popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

DHL-Fattura-446732-9302.xls

VBA_macro Generic Malware ScreenShot KeyLogger AntiDebug MSOffice File AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Oct. 26, 2021, 3:03 p.m. Oct. 26, 2021, 3:05 p.m.
Size 56.0KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Create Time/Date: Mon Oct 25 07:52:46 2021, Last Saved Time/Date: Mon Oct 25 07:52:48 2021, Security: 0, Author: DHL eCommerce
MD5 2172d539dfc31f78f87363c9837fc788
SHA256 7116c93e85891626185692c325a7c648bf2f2effb5c05582f77a18144b620164
CRC32 D8DDA55B
ssdeep 1536:GsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0w05bQK/64f6xMmsi0wW6l:GhlYkEIuPm3fNRZmbaoFhZhR0cixIHmp
Yara
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]
  • Generic_Malware_Zero - Generic Malware
  • Microsoft_Office_File_Zero - Microsoft Office File

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
175.208.134.138 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b527000
process_handle: 0xffffffff
1 0 0
description Run a KeyLogger rule KeyLogger
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
host 175.208.134.138
parent_process excel.exe martian_process "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /Embedding
Process injection Process 2972 resumed a thread in remote process 1536
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000460
suspend_count: 1
process_identifier: 1536
1 0 0
Lionic Trojan.Script.Generic.4!c
MicroWorld-eScan Trojan.GenericKD.37867439
McAfee X97M/Downloader.ic
Sangfor Malware.Generic-VBA.Save.Obfuscated
Cyren X97M/Agent.ABU.gen!Eldorado
Symantec Trojan.Mdropper
ESET-NOD32 VBA/TrojanDownloader.Agent.WXC
TrendMicro-HouseCall TROJ_FRS.VSNTJP21
Avast Other:Malware-gen [Trj]
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Trojan.GenericKD.37867439
Ad-Aware Trojan.GenericKD.37867439
Emsisoft Trojan.GenericKD.37867439 (B)
TrendMicro TROJ_FRS.VSNTJP21
McAfee-GW-Edition X97M/Downloader.ic
FireEye Trojan.GenericKD.37867439
Microsoft TrojanDownloader:O97M/Ursnif.ARJ!MTB
ZoneAlarm HEUR:Trojan.Script.Generic
GData Generic.Trojan.Agent.BHAUY7
MAX malware (ai score=87)
Ikarus Trojan.VBA.Agent
Fortinet VBA/Agent.WPW!tr
AVG Other:Malware-gen [Trj]