Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 10, 2022, 6:29 p.m.	Aug. 10, 2022, 6:31 p.m.

Size	1.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`7c22121f33af2bad8656ac09300416ee`
SHA256	`3d46e95284f93bbb76b3b7e1bf0e1b2d51e8a9411c2b6e649112f22f92de63c2`
CRC32	`A5B45A2C`
ssdeep	`3072:EMibZuTpOeyp0uTpOMckAKckAGDpA5NlKrss1ywKrss1ySZDvYONDzVFdC5wFVHv:B3F23FukA1kAb0rEbrESZU8wFjNHNI`
PDB Path	P:\Target\x86\ship\word\x-none\winword.pdbord.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Yara	IsPE32 - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature

Screenshot 2022-08-10 1024634534531232131325345354787721151 - Microsoft Office 365 Online.exe "C:\Users\test22\AppData\Local\Temp\Screenshot 2022-08-10 1024634534531232131325345354787721151 - Microsoft Office 365 Online.exe"
2196

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

P:\Target\x86\ship\word\x-none\winword.pdbord.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 10, 2022, 6:29 p.m.	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c81000 process_handle: 0xffffffff	1	0	0

Screenshot 2022-08-10 1024634534531232131325345354787721151 - Microsoft Office 365 Online.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All