popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

List of Compromised Systems.xls

VBA_macro Generic Malware Downloader ScreenShot KeyLogger AntiDebug MSOffice File AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 15, 2023, 5:30 p.m. June 15, 2023, 5:32 p.m.
Size 207.5KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Saira Kanwal/Human Resource, Last Saved By: Windows User, Name of Creating Application: Microsoft Excel, Last Printed: Tue Jul 21 07:37:01 2020, Create Time/Date: Wed Mar 1 06:35:45 2017, Last Saved Time/Date: Tue Jun 13 09:46:09 2023, Security: 0
MD5 fa595637dcb1d0dbaa41e928b1e59064
SHA256 df651fd93ce8c66fa57678bf6e387865151d489c2f5ddbd79fe05af9314f4b53
CRC32 62041A0F
ssdeep 6144:Bk3hOdsylKlgryzc4bNhZF+E+ZUwdARgrQp2lyEZPw3qKW:z8p2lyEu3
Yara
  • Microsoft_Office_File_Downloader_Zero - Microsoft Office File Downloader
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]
  • Microsoft_Office_File_Zero - Microsoft Office File
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 3044
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b927000
process_handle: 0xffffffff
1 0 0
description PWS Memory rule Generic_PWS_Memory_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Run a KeyLogger rule KeyLogger
description Take ScreenShot rule ScreenShot
parent_process excel.exe martian_process "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /Embedding
Process injection Process 3044 resumed a thread in remote process 2188
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000460
suspend_count: 1
process_identifier: 2188
1 0 0
Lionic Trojan.MSExcel.SLoad.4!c
Elastic malicious (high confidence)
ALYac GT:VB.Dridex.7.96232A5C
Cyren ABRisk.SCAX-7
Symantec Trojan.Gen.NPE.C
Avast Script:SNH-gen [Trj]
ClamAV Doc.Exploit.Generic-6923078-0
Kaspersky UDS:Trojan-Downloader.MSOffice.SLoad.gen
BitDefender GT:VB.Dridex.7.96232A5C
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
MicroWorld-eScan GT:VB.Dridex.7.96232A5C
TACHYON Suspicious/X97M.DNL.Gen
Emsisoft GT:VB.Dridex.7.96232A5C (B)
VIPRE GT:VB.Dridex.7.96232A5C
McAfee-GW-Edition Artemis!Trojan
FireEye GT:VB.Dridex.7.96232A5C
GData GT:VB.Dridex.7.96232A5C
Jiangmin MSWord/Downloader.s
Arcabit HEUR.VBA.Trojan.d
ZoneAlarm UDS:Trojan-Downloader.MSOffice.SLoad.gen
Microsoft Trojan:O97M/Sadoca.C!ml
Google Detected
MAX malware (ai score=81)
SentinelOne Static AI - Suspicious OLE
AVG Script:SNH-gen [Trj]