popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

snake.docx

Word 2007 file format(docx)
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Dec. 8, 2022, 9:45 a.m. Dec. 8, 2022, 9:47 a.m.
Size 36.3KB
Type Microsoft OOXML
MD5 3b853ae547346befe5f3d06290635cf6
SHA256 bc9d4eb09711f92e4e260efcf7e48906dca6bf239841e976972fd74dac412e2f
CRC32 6F19B80D
ssdeep 768:gXs7D7R7l3Dkd+d5pCM1OpoeySh3uJvPtKzggQpw6DF0v66vJDE/i6I1:R175AcHpSoeySVG3ggN/Y6RiZ
Yara
  • docx - Word 2007 file format detection

Name Response Post-Analysis Lookup
apps.identrust.com
A 23.44.173.97
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
A 23.44.173.113
23.43.165.105
paknavy-gov-pk.downld.net
A 185.205.187.234
185.205.187.234
IP Address Status Action
164.124.101.2 Active Moloch
185.205.187.234 Active Moloch
23.44.173.97 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49168 -> 185.205.187.234:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49162 -> 185.205.187.234:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49166 -> 185.205.187.234:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49168
185.205.187.234:443 		None None None
TLSv1
192.168.56.102:49162
185.205.187.234:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.downld.net 04:a5:76:5d:da:67:11:3c:f9:61:b0:5f:bb:45:55:38:d3:a7:2a:ee
TLSv1
192.168.56.102:49166
185.205.187.234:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.downld.net 04:a5:76:5d:da:67:11:3c:f9:61:b0:5f:bb:45:55:38:d3:a7:2a:ee

request GET http://apps.identrust.com/roots/dstrootcax3.p7c
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 3028
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6a16a000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\~$snake.docx
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000454
filepath: C:\Users\test22\AppData\Local\Temp\~$snake.docx
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$snake.docx
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0