popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

E3406792198.xls

MS_Excel_Hidden_Macro_Sheet ScreenShot KeyLogger AntiDebug MSOffice File AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 May 20, 2022, 10:31 a.m. May 20, 2022, 10:33 a.m.
Size 327.5KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Posik, Last Saved By: Dream, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 18:19:34 2015, Last Saved Time/Date: Thu May 19 12:09:59 2022, Security: 0
MD5 6fa95c9fc12894519b4332e029f564db
SHA256 348d709ab212ddbd34fdcae6d27e7f1fb51569f3cb6d817889273682290a2f3b
CRC32 DADFD3BC
ssdeep 6144:WKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgRU8VBCMiEXKLy+nkuxt2HvfIHlkmnatAkE:rjC7y+X72XxQgzsxQBw
Yara
  • MS_Excel_Hidden_Macro_Sheet - (no description)
  • Microsoft_Office_File_Zero - Microsoft Office File

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6bce7000
process_handle: 0xffffffff
1 0 0
description Take ScreenShot rule ScreenShot
description PWS Memory rule Generic_PWS_Memory_Zero
description Run a KeyLogger rule KeyLogger
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
parent_process excel.exe martian_process "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /Embedding
Process injection Process 2216 resumed a thread in remote process 2324
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000464
suspend_count: 1
process_identifier: 2324
1 0 0
Lionic Trojan.Script.Generic.4!c
MicroWorld-eScan XLM.Trojan.Abracadabra.8.Gen
FireEye XLM.Trojan.Abracadabra.8.Gen
McAfee RDN/Silentbuilder
Sangfor Malware.Generic-XLM.Save.ma29
K7AntiVirus Trojan ( 0059086a1 )
K7GW Trojan ( 0059086a1 )
Cyren XF/Qbot.I.gen!Eldorado
Symantec CL.Suspexec!gen128
ESET-NOD32 DOC/TrojanDownloader.Agent.DOV
Avast XLS:Nastya [Trj]
Kaspersky HEUR:Trojan.Script.Generic
BitDefender XLM.Trojan.Abracadabra.8.Gen
Ad-Aware XLM.Trojan.Abracadabra.8.Gen
Emsisoft XLM.Trojan.Abracadabra.8.Gen (B)
McAfee-GW-Edition Artemis!Trojan
Sophos Troj/DocDl-AGCY
ViRobot XLS.Z.Agent.335360
GData XLM.Trojan.Abracadabra.8.Gen
ALYac XLM.Trojan.Abracadabra.8.Gen
MAX malware (ai score=99)
Tencent Trojan.MsOffice.Macro40.11020320
Ikarus Trojan-Downloader.XLM.Agent
Fortinet MSExcel/Agent.DKF!tr.dldr
AVG XLS:Nastya [Trj]