Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

ddd.xlsb

Excel Binary Workbook file format(xlsb) ZIP Format

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 29, 2023, 6:18 p.m.	May 29, 2023, 6:22 p.m.

Size	12.9KB
Type	Microsoft Excel 2007+
MD5	`0e65c589e0c6edffb3b305e7595a271b`
SHA256	`83d171ffcf9f88d4e1408e34ef2829c849b90748e1b7b2da0679d6ee39cd958f`
CRC32	`4B442935`
ssdeep	`192:0TUa42Szpq9H5FEBPJ2Z3KmFOt+FnzKqiWlw0QSFMaxon0YSntQ:ZaHiBPJ2cEnz3lwduMaxon0i`
Yara	zip_file_format - ZIP file format xlsb - Excel Binary Workbook file format detection

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\ddd.xlsb
2564

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
117.18.232.200	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (9 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 29, 2023, 6:18 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f5b1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory May 29, 2023, 6:18 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f60f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory May 29, 2023, 6:18 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f60f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory May 29, 2023, 6:18 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f551000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory May 29, 2023, 6:18 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70e11000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory May 29, 2023, 6:18 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory May 29, 2023, 6:18 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory May 29, 2023, 6:18 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory May 29, 2023, 6:18 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile May 29, 2023, 6:18 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x000003a4 filepath: C:\Users\test22\AppData\Local\Temp\~$ddd.xlsb desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES\|DELETE\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$ddd.xlsb create_options: 4198496 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0
NtCreateFile May 29, 2023, 6:18 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000410 filepath: C:\Users\test22\AppData\Local\Temp\~$ddd.xlsb desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES\|DELETE\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$ddd.xlsb create_options: 4198496 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0

File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 events)

Alibaba	Exploit:Application/CVE-2017-11882.05d6ac28
Google	Detected
Ikarus	Exploit.CVE-2017-11882

Communicates with host for which no DNS query was performed (1 event)

host

117.18.232.200