popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1.xlsb

Excel Binary Workbook file format(xlsb)
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 2, 2021, 2:36 p.m. Nov. 2, 2021, 2:38 p.m.
Size 211.9KB
Type Microsoft Excel 2007+
MD5 dee6841dad2810dbb7d487803e3f2b4c
SHA256 f7c19c2b33e47e2ab2d742587e9b593ac3d8756caf37c710ae1f2800aeb144a9
CRC32 5AF0E148
ssdeep 6144:8LuLooVw6XdPYlqpxEHjXaAtt3A1DXy47LZxUvsQafh:8KLoaXdWEEDXaAzg+iU0Q8
Yara
  • xlsb - Excel Binary Workbook file format detection

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6bd82000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000470
filepath: C:\Users\test22\AppData\Local\Temp\~$1.xlsb
desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$1.xlsb
create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE)
status_info: 2 (FILE_CREATED)
share_access: 1 (FILE_SHARE_READ)
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef60000
process_handle: 0xffffffff
1 0 0
DrWeb X97M.DownLoader.763
MicroWorld-eScan Trojan.GenericKD.47271096
CAT-QuickHeal XLS4.IcedID.42146
Arcabit Trojan.Generic.D2D14CB8
Cyren XLSB/Agent.JZ.gen!Camelot
ESET-NOD32 a variant of DOC/TrojanDropper.Agent.WL
BitDefender Trojan.GenericKD.47271096
Ad-Aware Trojan.GenericKD.47271096
Emsisoft Trojan.GenericKD.47271096 (B)
McAfee-GW-Edition X97M/Downloader.ky
FireEye Trojan.GenericKD.47271096
GData Trojan.GenericKD.47271096
Avira W97M/Agent.cpm
MAX malware (ai score=85)
Microsoft TrojanDownloader:O97M/EncDoc.PMSH!MTB
Cynet Malicious (score: 99)
McAfee X97M/Downloader.ky
Fortinet VBA/Agent.WL!tr