popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

8_IT07267585346_12_06122022_081000.xls

VBA_macro Generic Malware ScreenShot KeyLogger AntiDebug MSOffice File AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Dec. 15, 2022, 10:10 a.m. Dec. 15, 2022, 10:13 a.m.
Size 56.5KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: DHL, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Dec 6 07:24:24 2022, Last Saved Time/Date: Tue Dec 6 07:26:25 2022, Security: 0
MD5 c5085c4e8f6e4ebea457ac4d2dbec935
SHA256 2463992063651f1d340b1ee0f45920b8cbe385aa2a099664b6f2c0c82469acc2
CRC32 DACCBC0E
ssdeep 1536:rblYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0fd50wMtBYn7i/7HGsiF:rblYkEIuPm3fNRZmbaoFhZhR0cixIHmQ
Yara
  • Generic_Malware_Zero - Generic Malware
  • Microsoft_Office_File_Zero - Microsoft Office File
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 3052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b927000
process_handle: 0xffffffff
1 0 0
description Take ScreenShot rule ScreenShot
description PWS Memory rule Generic_PWS_Memory_Zero
description Run a KeyLogger rule KeyLogger
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
parent_process excel.exe martian_process "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /Embedding
Process injection Process 3052 resumed a thread in remote process 1784
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000464
suspend_count: 1
process_identifier: 1784
1 0 0
Lionic Trojan.MSExcel.Alien.4!c
Elastic malicious (high confidence)
MicroWorld-eScan VB:Trojan.Valyria.7557
FireEye VB:Trojan.Valyria.7557
CAT-QuickHeal X97M.Dropper.CB
ALYac Trojan.Downloader.XLS.Gen
Arcabit VB:Trojan.Valyria.D1D85
VirIT X97M.Ursnif.DNB
Cyren X97M/Agent.BLC.gen!Eldorado
Symantec Trojan.Gen.NPE.C
ESET-NOD32 VBA/TrojanDownloader.Agent.YOP
TrendMicro-HouseCall TROJ_GEN.F04IE00L622
Kaspersky HEUR:Trojan.MSOffice.Alien.gen
BitDefender VB:Trojan.Valyria.7557
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
Ad-Aware VB:Trojan.Valyria.7557
VIPRE VB:Trojan.Valyria.7557
TrendMicro TROJ_GEN.F04IE00L622
McAfee-GW-Edition BehavesLike.OLE2.GenDownloader.ql
Emsisoft Trojan.GenericKD.64077483 (B)
Ikarus Trojan-Downloader.VBA.Agent
Google Detected
Antiy-AVL Trojan[Downloader]/MSOffice.Agent.base
Microsoft Trojan:Win32/Leonem
GData VB:Trojan.Valyria.7557
MAX malware (ai score=81)
SentinelOne Static AI - Malicious OLE
Fortinet VBA/Agent.YOP!tr