popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

test3.doc

VBA_macro Generic Malware MSOffice File AntiDebug AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Jan. 6, 2024, 10:31 a.m. Jan. 6, 2024, 10:41 a.m.
Size 167.5KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: wound, Template: Normal.dotm, Last Saved By: wound, Revision Number: 43, Name of Creating Application: Microsoft Office Word, Total Editing Time: 19:45:00, Create Time/Date: Sun Dec 17 11:57:00 2023, Last Saved Time/Date: Mon Dec 18 07:42:00 2023, Number of Pages: 1, Number of Words: 191, Number of Characters: 1094, Security: 0
MD5 4333cf43659835679e5f6e9371611b46
SHA256 23c54a0185284f7e9a0231f5bbd4c3527e2750c0686cb5744cb388059fbb0ec9
CRC32 A233C2AB
ssdeep 3072:EWKaAGgbsFlW4x6MdBHwYHvJFCNu7Vx6d:qaZisFlW4cIBQYPWT
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
configure.syscatec.com
A 69.46.5.226
69.46.5.226
IP Address Status Action
164.124.101.2 Active Moloch
69.46.5.226 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 69.46.5.226:443 -> 192.168.56.101:49169 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49177 -> 69.46.5.226:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49173 -> 69.46.5.226:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49181 -> 69.46.5.226:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49176 -> 69.46.5.226:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 69.46.5.226:443 -> 192.168.56.101:49187 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 69.46.5.226:443 -> 192.168.56.101:49171 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49185 -> 69.46.5.226:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49192 -> 69.46.5.226:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 69.46.5.226:443 -> 192.168.56.101:49174 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49172 -> 69.46.5.226:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 69.46.5.226:443 -> 192.168.56.101:49179 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 69.46.5.226:443 -> 192.168.56.101:49178 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49167 -> 69.46.5.226:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49180 -> 69.46.5.226:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 69.46.5.226:443 -> 192.168.56.101:49175 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 69.46.5.226:443 -> 192.168.56.101:49182 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 69.46.5.226:443 -> 192.168.56.101:49183 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 69.46.5.226:443 -> 192.168.56.101:49186 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49184 -> 69.46.5.226:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49188 -> 69.46.5.226:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49189 -> 69.46.5.226:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 69.46.5.226:443 -> 192.168.56.101:49191 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 69.46.5.226:443 -> 192.168.56.101:49190 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e251000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e2a5000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e531000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e221000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x65001000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e021000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e024000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e011000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06b90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06b90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06ba0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06bb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x507c1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c5f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dcd5000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2808
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fbc2000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\~$test3.doc
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000198
filepath: C:\Users\test22\AppData\Local\Temp\~$test3.doc
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$test3.doc
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

WSASend

 buffer: yue˜­W–ˆwø­‡$¬§ŠàЀšZ%Vó͖ë›Çðšo/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 592
0 0

WSASend

 buffer: 51e˜­W«ý‡NÃVP›€Ã¶ïâa]lÐÆíE1g  ÿ
socket: 592
0 0

WSASend

 buffer: 51e˜­]  BM]9: à 3e-ÎÈ„«×gs  ÿ
socket: 704
0 0

WSASend

 buffer: yue˜­]]ð±tÉrä¿UãˆÂ˜¢ž@`J‹ðÝãˆâ/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 704
0 0

WSASend

 buffer: yue˜­h[=€cwc³ò*GÐ!>D›B"jk<Ò øáF/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 704
0 0

WSASend

 buffer: 51e˜­hZé…dÚXU¿Û„&pCã½DÛ%BÑ7  ÿ
socket: 704
0 0

WSASend

 buffer: 51e˜­r̸ýs¿,Ì+àôF0Ä:Vß ø¡ßÅ 9ǔê  ÿ
socket: 704
0 0

WSASend

 buffer: yue˜­s'Ç&ƒæANˆ©gvÿô…þ¡vúå ø½Ú/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 704
0 0

WSASend

 buffer: yue˜­}6 ¥iYڅÃwãháv “5+qïr\‰aO/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 204
0 0

WSASend

 buffer: 51e˜­~_ Ö†'¯4mr0p®›Ù¾ÕóÆ™  ÿ
socket: 204
0 0

WSASend

 buffer: 51e˜­ˆÊŠ[Ajô€*†£Ô®Ã9†d¢`wdÀDFnÄ  ÿ
socket: 204
0 0

WSASend

 buffer: yue˜­ˆ&îæ]~7µwsKT¥0™h¬M”T½Ò/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 204
0 0

WSASend

 buffer: yue˜­“œÝÀ^]¦+Çý"ŠôÜMQ¡_qˆ0NQ¤Ê/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 412
0 0

WSASend

 buffer: 51e˜­“Ñ]æÉ­Lš!æÿWï“;È»JÙÛïòÙåÏ  ÿ
socket: 412
0 0

WSASend

 buffer: 51e˜­¨_Ý&7ÌAžaÝÉ1õ’ûmrhÐH ”¶ ’W  ÿ
socket: 560
0 0

WSASend

 buffer: yue˜­žÿ 4¸ÿO[óKe-ƃr³=²Îr)Ǭk#]…/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 560
0 0

WSASend

 buffer: yue˜­¨Èoü©raJ `{H‹™«pÖxüéêËÁ/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 560
0 0

WSASend

 buffer: 51e˜­©‹ë\GÜS`‘6֊³M) qã3wçþB&  ÿ
socket: 560
0 0

WSASend

 buffer: 51e˜­³6~|hù¤ý`’õ5f¯ŠŒµ²¼µ­šÞ  ÿ
socket: 456
0 0

WSASend

 buffer: yue˜­³Üõd­…}p¢j³ö£èQ³’÷k€4dèÑÕ^Œ/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 456
0 0

WSASend

 buffer: yue˜­¾Ú_ÅäŸ9/âðqfˆÆð䨚-(KEÛ/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 456
0 0

WSASend

 buffer: 51e˜­¾<Ê ;¥Þür®™`'»P{bƒ^7ÀÂC:KÚ  ÿ
socket: 456
0 0

WSASend

 buffer: 51e˜­É‚ÆöÇ+½çõ*E_ˆf<†É§ÉéQìm41Ghÿ8  ÿ
socket: 456
0 0

WSASend

 buffer: yue˜­Ékzª¨~(R¼_Ý«’éR†Üdó:„Í£W/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 456
0 0
Time & API Arguments Status Return Repeated

WSASend

 buffer: yue˜­W–ˆwø­‡$¬§ŠàЀšZ%Vó͖ë›Çðšo/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 592
0 0

WSASend

 buffer: 51e˜­W«ý‡NÃVP›€Ã¶ïâa]lÐÆíE1g  ÿ
socket: 592
0 0

WSASend

 buffer: 51e˜­]  BM]9: à 3e-ÎÈ„«×gs  ÿ
socket: 704
0 0

WSASend

 buffer: yue˜­]]ð±tÉrä¿UãˆÂ˜¢ž@`J‹ðÝãˆâ/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 704
0 0

WSASend

 buffer: yue˜­h[=€cwc³ò*GÐ!>D›B"jk<Ò øáF/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 704
0 0

WSASend

 buffer: 51e˜­hZé…dÚXU¿Û„&pCã½DÛ%BÑ7  ÿ
socket: 704
0 0

WSASend

 buffer: 51e˜­r̸ýs¿,Ì+àôF0Ä:Vß ø¡ßÅ 9ǔê  ÿ
socket: 704
0 0

WSASend

 buffer: yue˜­s'Ç&ƒæANˆ©gvÿô…þ¡vúå ø½Ú/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 704
0 0

WSASend

 buffer: yue˜­}6 ¥iYڅÃwãháv “5+qïr\‰aO/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 204
0 0

WSASend

 buffer: 51e˜­~_ Ö†'¯4mr0p®›Ù¾ÕóÆ™  ÿ
socket: 204
0 0

WSASend

 buffer: 51e˜­ˆÊŠ[Ajô€*†£Ô®Ã9†d¢`wdÀDFnÄ  ÿ
socket: 204
0 0

WSASend

 buffer: yue˜­ˆ&îæ]~7µwsKT¥0™h¬M”T½Ò/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 204
0 0

WSASend

 buffer: yue˜­“œÝÀ^]¦+Çý"ŠôÜMQ¡_qˆ0NQ¤Ê/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 412
0 0

WSASend

 buffer: 51e˜­“Ñ]æÉ­Lš!æÿWï“;È»JÙÛïòÙåÏ  ÿ
socket: 412
0 0

WSASend

 buffer: 51e˜­¨_Ý&7ÌAžaÝÉ1õ’ûmrhÐH ”¶ ’W  ÿ
socket: 560
0 0

WSASend

 buffer: yue˜­žÿ 4¸ÿO[óKe-ƃr³=²Îr)Ǭk#]…/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 560
0 0

WSASend

 buffer: yue˜­¨Èoü©raJ `{H‹™«pÖxüéêËÁ/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 560
0 0

WSASend

 buffer: 51e˜­©‹ë\GÜS`‘6֊³M) qã3wçþB&  ÿ
socket: 560
0 0

WSASend

 buffer: 51e˜­³6~|hù¤ý`’õ5f¯ŠŒµ²¼µ­šÞ  ÿ
socket: 456
0 0

WSASend

 buffer: yue˜­³Üõd­…}p¢j³ö£èQ³’÷k€4dèÑÕ^Œ/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 456
0 0

WSASend

 buffer: yue˜­¾Ú_ÅäŸ9/âðqfˆÆð䨚-(KEÛ/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 456
0 0

WSASend

 buffer: 51e˜­¾<Ê ;¥Þür®™`'»P{bƒ^7ÀÂC:KÚ  ÿ
socket: 456
0 0

WSASend

 buffer: 51e˜­É‚ÆöÇ+½çõ*E_ˆf<†É§ÉéQìm41Ghÿ8  ÿ
socket: 456
0 0

WSASend

 buffer: yue˜­Ékzª¨~(R¼_Ý«’éR†Üdó:„Í£W/5 ÀÀÀ À 284ÿconfigure.syscatec.com  
socket: 456
0 0
cve CVE-2013-3906
parent_process winword.exe martian_process cMd /c C:\Users\Public\window.vbs
Process injection Process 2728 resumed a thread in remote process 2808
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000230
suspend_count: 1
process_identifier: 2808
1 0 0
file C:\Windows\SysWOW64\wscript.exe
Lionic Trojan.MSWord.Amphitryon.4!c
Elastic malicious (high confidence)
DrWeb Exploit.Siggen3.44322
MicroWorld-eScan VBA:Amphitryon.1635
Skyhigh BehavesLike.OLE2.Downloader.cb
Symantec Trojan.Gen.MBT
ESET-NOD32 VBA/TrojanDropper.Agent.CXV
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.MSOffice.SAgent.gen
BitDefender VBA:Amphitryon.1635
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
Tencent Win32.Trojan.Malware.Szfl
Emsisoft VBA:Amphitryon.1635 (B)
Google Detected
F-Secure Malware.W97M/Redcap.qbumx
VIPRE VBA:Amphitryon.1635
SentinelOne Static AI - Suspicious OLE
Varist ABRisk.LJPV-11
Avira W97M/Redcap.qbumx
MAX malware (ai score=89)
Antiy-AVL Trojan[Downloader]/MSOffice.Agent
Kingsoft Win32.Troj.Undef.a
Microsoft Trojan:Win32/Leonem
Arcabit VBA:Amphitryon.D663
ZoneAlarm HEUR:Trojan.MSOffice.SAgent.gen
GData VBA:Amphitryon.1635
Cynet Malicious (score: 99)
TACHYON Suspicious/W97M.DRP.Gen
Rising Dropper.Agent/VBA!8.11766 (TOPIS:E0:9ddheGUZbPN)
Ikarus VBA.Amphitryon
AVG Script:SNH-gen [Trj]