Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

tst.xls

MSOffice File

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 21, 2023, 5:05 p.m.	June 21, 2023, 5:08 p.m.

Size	1.5MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 936, Last Saved By: Liu, Winnie, Name of Creating Application: Microsoft Excel, Total Editing Time: Sat Dec 30 00:00:00 1899, Last Printed: Sat Dec 30 00:00:00 1899, Create Time/Date: Wed Dec 13 06:51:54 2006, Last Saved Time/Date: Mon Jun 19 10:00:09 2023, Number of Pages: 0, Number of Words: 0, Number of Characters: 0, Security: 0
MD5	`bce13902533947cb73decdacecdbf12c`
SHA256	`f8d9434b1738968157be8e71407d31245463245a932f02df836d3059a2a7bb6a`
CRC32	`58E5E622`
ssdeep	`49152:qIIYgkspy2IQF7LKZcJehi5YKntjFETUJT:Z7gksJIO7eSehiKL`
Yara	Microsoft_Office_File_Zero - Microsoft Office File

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\tst.xls
2656

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (11 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 21, 2023, 5:05 p.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f5b1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 21, 2023, 5:05 p.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f60f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 21, 2023, 5:05 p.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f60f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 21, 2023, 5:05 p.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f4f1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 21, 2023, 5:05 p.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f4f1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 21, 2023, 5:05 p.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70e11000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 21, 2023, 5:05 p.m.	process_identifier: 2656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05630000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 21, 2023, 5:05 p.m.	process_identifier: 2656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05630000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 21, 2023, 5:05 p.m.	process_identifier: 2656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05640000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 21, 2023, 5:05 p.m.	process_identifier: 2656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 21, 2023, 5:05 p.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f491000 process_handle: 0xffffffff	1	0	0