Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 31, 2022, 2:48 p.m.	March 31, 2022, 2:50 p.m.

Size	68.6KB
Type	Microsoft Word 2007+
MD5	`ce00749c908de017010055a83ac0654f`
SHA256	`f265a04e08a79ea6a4eeacd8294b3af2e1a08ae131018dd1ca195ae900437767`
CRC32	`CE77A3B5`
ssdeep	`1536:uQA1b8wjauSm/pPC106sReBofMg0ghHmh9fejMbRQ4c:uL14wjaO/IJ4qCGhNecVc`
Yara	docx - Word 2007 file format detection Doc_XML_Downloader - Detect a MS Office document with embedded XML Downloader

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" "C:\Users\test22\AppData\Local\Temp\NFT 분할.docx"
2772

Name	Response	Post-Analysis Lookup
naveicoipd.tech	A 209.126.83.186	209.126.83.186

IP Address	Status	Action
164.124.101.2	Active	Moloch
209.126.83.186	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Performs some HTTP requests (6 events)

request	OPTIONS http://naveicoipd.tech/ACMS/0lvNAK1t/
request	OPTIONS http://naveicoipd.tech/ACMS/0lvNAK1t
request	PROPFIND http://naveicoipd.tech/ACMS/0lvNAK1t
request	PROPFIND http://naveicoipd.tech/ACMS
request	PROPFIND http://naveicoipd.tech/ACMS/
request	GET http://naveicoipd.tech/ACMS/0lvNAK1t/accountsTemplate?uid=bslkhglk

Allocates read-write-execute memory (usually to unpack itself) (40 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eae1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eac1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ea61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ea41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ea31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ea21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ea11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ea01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e9c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e9a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e961000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e911000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e8f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e8d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e7d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e8b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e711000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e765000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e701000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e641000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e644000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e4e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e4e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e441000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e457000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ccf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2022, 2:48 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e3d5000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$NFT 분할.docx

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile March 31, 2022, 2:48 p.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000003f8 filepath: C:\Users\test22\AppData\Local\Temp\~$NFT 분할.docx desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$NFT 분할.docx create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Libraries known to be associated with a CVE were requested (may be False Positive) (1 event)

cve	CVE-2013-3906

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 events)

Lionic	Trojan.MSOffice.SLoad.a!c
MicroWorld-eScan	Trojan.GenericKD.48753280
FireEye	Trojan.GenericKD.48753280
ALYac	Trojan.Downloader.DOC.Gen
Alibaba	TrojanDownloader:Office/SLoad.74b57680
Arcabit	Trojan.Generic.D2E7EA80
Symantec	W97M.Downloader
ESET-NOD32	DOC/TrojanDownloader.Agent.CF
TrendMicro-HouseCall	TROJ_FRS.VSNTCT22
Avast	Other:Malware-gen [Trj]
Kaspersky	HEUR:Trojan-Downloader.MSOffice.SLoad.gen
BitDefender	Trojan.GenericKD.48753280
NANO-Antivirus	Exploit.Xml.CVE-2017-0199.equmby
Tencent	Win32.Trojan-downloader.Agent.Syrg
Ad-Aware	Trojan.GenericKD.48753280
TrendMicro	TROJ_FRS.VSNTCT22
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKD.48753280 (B)
Avira	W97M/Dldr.Agent.kacuj
ViRobot	DOC.Z.Agent.70220
GData	Trojan.GenericKD.48753280
Cynet	Malicious (score: 99)
AhnLab-V3	Downloader/XML.Generic
Zoner	Probably Heur.W97OleLink
Fortinet	MSOffice/Agent.CF!tr
AVG	Other:Malware-gen [Trj]

NFT 분할.docx

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All