popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

MUFG_JOB_DESCRIPTION.docx

Word 2007 file format(docx)
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 16, 2022, 10:27 a.m. Sept. 16, 2022, 10:29 a.m.
Size 2.6MB
Type Microsoft OOXML
MD5 0a8a4e2d462fb4b56ea98b25d5b1bdb3
SHA256 5816eb32cbaadfc3477c823293a8c49cdf690b443c8fa3c19f98399c143df2b3
CRC32 80460438
ssdeep 49152:yKyWrBcD/KESkcCFcsGPthcmy2i7f8I/iUsBaDaMgIGqyzUvWU9G3eqiR+Rt/Dqn:ZcjSSFcsWcm3fXlmKEL9KxjbDZFu
Yara
  • docx - Word 2007 file format detection

Name Response Post-Analysis Lookup
apps.identrust.com
A 121.254.136.27
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
A 121.254.136.57
23.43.165.105
verify.azure-protect.online
A 152.89.247.87
152.89.247.87
IP Address Status Action
121.254.136.57 Active Moloch
152.89.247.87 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49170 -> 152.89.247.87:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49162 -> 152.89.247.87:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49167 -> 152.89.247.87:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49169 -> 152.89.247.87:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49170
152.89.247.87:443 		None None None
TLSv1
192.168.56.102:49167
152.89.247.87:443 		None None None
TLSv1
192.168.56.102:49162
152.89.247.87:443 		C=US, O=Let's Encrypt, CN=R3 CN=verify.azure-protect.online 05:f0:61:22:2c:09:b8:63:2f:b8:30:fd:ab:d9:06:35:82:f3:e3:e6
TLSv1
192.168.56.102:49169
152.89.247.87:443 		C=US, O=Let's Encrypt, CN=R3 CN=verify.azure-protect.online 05:f0:61:22:2c:09:b8:63:2f:b8:30:fd:ab:d9:06:35:82:f3:e3:e6

request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request OPTIONS https://verify.azure-protect.online/EcCm9WiaysW/D%2BsYq1Io/yVMuSbkgQZ/Vp6bzP5LXe/Ec08P4lt6g/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6a52a000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\~$FG_JOB_DESCRIPTION.docx
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000454
filepath: C:\Users\test22\AppData\Local\Temp\~$FG_JOB_DESCRIPTION.docx
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$FG_JOB_DESCRIPTION.docx
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
MicroWorld-eScan Trojan.Groooboor.Gen.33
FireEye Trojan.Groooboor.Gen.33
Arcabit Trojan.Groooboor.Gen.33
BitDefender Trojan.Groooboor.Gen.33
NANO-Antivirus Exploit.Xml.CVE-2017-0199.equmby
Emsisoft Trojan.Groooboor.Gen.33 (B)
VIPRE Trojan.Groooboor.Gen.33
McAfee-GW-Edition Artemis
MAX malware (ai score=89)
GData Trojan.Groooboor.Gen.33