popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

qqdownloadftnv5

VBA_macro Generic Malware PWS ScreenShot KeyLogger Http API AntiDebug MSOffice File AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 7, 2023, 5:30 p.m. Sept. 7, 2023, 5:44 p.m.
Size 389.0KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 936, Author: Michael Behnsen (DE-HAM ECU Worldwide), Last Saved By: May Ma Ping (CN-DLC ECU Worldwide), Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Mar 20 01:58:26 2019, Last Saved Time/Date: Thu Aug 17 09:26:40 2023, Security: 0
MD5 9cbc21a9ed6e1525332557904760e570
SHA256 d01d9b66eafe89da8b1b3cb45b194dc7d770c55bcabfb752c13f2b835b864f05
CRC32 AC9D2494
ssdeep 6144:6bVflDcacWc6oRaHUNJUPG1o98Bjr6PRBy9SY9bNtdbwtm8shKW4Idf9t8qre04I:Wqre04CDiWmi7DPoCR71
Yara
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]
  • Microsoft_Office_File_Zero - Microsoft Office File
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c318000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c512000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef70000
process_handle: 0xffffffff
1 0 0
description Match Windows Http API call rule Str_Win32_Http_API
description PWS Memory rule Generic_PWS_Memory_Zero
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Run a KeyLogger rule KeyLogger
parent_process excel.exe martian_process "C:\Program Files (x86)\Microsoft Office\Office15\EXCEL.EXE" /Embedding
Process injection Process 1488 resumed a thread in remote process 2536
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000548
suspend_count: 1
process_identifier: 2536
1 0 0
Bkav X97M.Kagatang
Elastic malicious (high confidence)
MicroWorld-eScan VB:Trojan.VBA.Agent.BEL
FireEye VB:Trojan.VBA.Agent.BEL
CAT-QuickHeal X97M.Agent.34591
ALYac VB:Trojan.VBA.Agent.BEL
Sangfor Malware.Generic-Macro.Save.1d3b7388
K7AntiVirus Virus ( 005a5d481 )
K7GW Virus ( 005a5d481 )
Arcabit VB:Trojan.VBA.Agent.BEL
Baidu VBA.Trojan.Agent.el
Cyren X97M/Laroux.gen
Symantec X97M.Laroux.gen
ESET-NOD32 Escoper.B
Cynet Malicious (score: 99)
TrendMicro-HouseCall Trojan.X97M.EMOTET.YXCDFZ
Avast VBA:Dropper-BC [Trj]
ClamAV Xls.Malware.ExcelSic-10004731-1
Kaspersky Virus.MSExcel.Laroux.lh
BitDefender VB:Trojan.VBA.Agent.BEL
NANO-Antivirus Trojan.Script.Agent.fkbqor
Sophos XM/Laroux-BW
F-Secure Heuristic.HEUR/Macro.Downloader.PWA.Gen
DrWeb MACRO.Virus
VIPRE VB:Trojan.VBA.Agent.BEL
TrendMicro Trojan.X97M.EMOTET.YXCDFZ
McAfee-GW-Edition BehavesLike.OLE2.Laroux.fl
Emsisoft VB:Trojan.VBA.Agent.BEL (B)
SentinelOne Static AI - Malicious OLE
Jiangmin MSExcel.Script.acb
Avira HEUR/Macro.Downloader.PWA.Gen
Antiy-AVL Trojan[Downloader]/MSOffice.Agent.n
Microsoft Virus:X97M/Laroux.A
ViRobot X97M.Kangatang.A
ZoneAlarm Virus.MSExcel.Laroux.lh
GData VB:Trojan.VBA.Agent.BEL
Google Detected
AhnLab-V3 X97M/Laroux
Acronis suspicious
McAfee X97M/Laroux.f
MAX malware (ai score=85)
Rising Macro.Excel.Laroux.hm (CLASSIC)
Ikarus Virus.XLS.Escoper
Fortinet VBA/Valyria.3004!tr
AVG VBA:Dropper-BC [Trj]