popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

4501185419.xls

VBA_macro Generic Malware MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Jan. 18, 2024, 7:14 a.m. Jan. 18, 2024, 7:16 a.m.
Size 674.5KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 00:00:00 2006, Last Saved Time/Date: Wed Jan 25 16:24:48 2023, Security: 0
MD5 6ab14c920d762241b62aaa41f0982987
SHA256 14ea594b7f0fe9efb3fcd31f36febd5ebc0f686b85284131874296f398bc2842
CRC32 1EF5CC2B
ssdeep 12288:KAaVfMrz1mcpsL8Z9FovaVfMrzsmoLsLmZ9ZAvaVfBrz1mzpsLmZjF:KQfkcK8Z9FotfroEmZ9ZAQfkzKmZjF
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
  • Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
198.46.174.165 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x75c5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x747ff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x75c6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x747fc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x746f98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74741414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74757b68
MdCallBack-0x620fb3 excel+0x3f4bb1 @ 0x2f814bb1
MdCallBack-0x8f811c excel+0x11da48 @ 0x2f53da48
MdCallBack-0x8f7e7a excel+0x11dcea @ 0x2f53dcea
MdCallBack-0x8ed92f excel+0x128235 @ 0x2f548235
MdCallBack-0x4e034f excel+0x535815 @ 0x2f955815
MdCallBack-0x4e041d excel+0x535747 @ 0x2f955747
MdCallBack-0x67d17e excel+0x3989e6 @ 0x2f7b89e6
MdCallBack-0xa0d6e1 excel+0x8483 @ 0x2f428483
MdCallBack-0xa0fd82 excel+0x5de2 @ 0x2f425de2
MdCallBack-0xa120c2 excel+0x3aa2 @ 0x2f423aa2
MdCallBack-0xa12378 excel+0x37ec @ 0x2f4237ec
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 3699616
registers.edi: 1953561104
registers.eax: 3699616
registers.ebp: 3699696
registers.edx: 0
registers.ebx: 8187308
registers.esi: 2147944126
registers.ecx: 2797098069
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x75c5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x747ff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x75c6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x747fc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x746f98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x746fb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x746fb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x746fb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x746fa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x7477a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x747577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x747414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74757b68
MdCallBack-0x620fb3 excel+0x3f4bb1 @ 0x2f814bb1
MdCallBack-0x8f811c excel+0x11da48 @ 0x2f53da48
MdCallBack-0x8f7e7a excel+0x11dcea @ 0x2f53dcea
MdCallBack-0x8ed92f excel+0x128235 @ 0x2f548235
MdCallBack-0x4e034f excel+0x535815 @ 0x2f955815
MdCallBack-0x4e041d excel+0x535747 @ 0x2f955747
MdCallBack-0x67d17e excel+0x3989e6 @ 0x2f7b89e6
MdCallBack-0xa0d6e1 excel+0x8483 @ 0x2f428483
MdCallBack-0xa0fd82 excel+0x5de2 @ 0x2f425de2
MdCallBack-0xa120c2 excel+0x3aa2 @ 0x2f423aa2
MdCallBack-0xa12378 excel+0x37ec @ 0x2f4237ec
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 3699308
registers.edi: 1953561104
registers.eax: 3699308
registers.ebp: 3699388
registers.edx: 0
registers.ebx: 8185724
registers.esi: 2147944122
registers.ecx: 2797098069
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6f5b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6f60f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6f60f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6f4f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6f4f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6f381000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6f711000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05320000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05320000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05330000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05380000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Application Crash Process EXCEL.EXE with pid 2548 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x75c5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x747ff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x75c6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x747fc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x746f98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74741414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74757b68
MdCallBack-0x620fb3 excel+0x3f4bb1 @ 0x2f814bb1
MdCallBack-0x8f811c excel+0x11da48 @ 0x2f53da48
MdCallBack-0x8f7e7a excel+0x11dcea @ 0x2f53dcea
MdCallBack-0x8ed92f excel+0x128235 @ 0x2f548235
MdCallBack-0x4e034f excel+0x535815 @ 0x2f955815
MdCallBack-0x4e041d excel+0x535747 @ 0x2f955747
MdCallBack-0x67d17e excel+0x3989e6 @ 0x2f7b89e6
MdCallBack-0xa0d6e1 excel+0x8483 @ 0x2f428483
MdCallBack-0xa0fd82 excel+0x5de2 @ 0x2f425de2
MdCallBack-0xa120c2 excel+0x3aa2 @ 0x2f423aa2
MdCallBack-0xa12378 excel+0x37ec @ 0x2f4237ec
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 3699616
registers.edi: 1953561104
registers.eax: 3699616
registers.ebp: 3699696
registers.edx: 0
registers.ebx: 8187308
registers.esi: 2147944126
registers.ecx: 2797098069
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x75c5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x747ff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x75c6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x747fc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x746f98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x746fb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x746fb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x746fb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x746fa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x7477a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x747577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x747414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74757b68
MdCallBack-0x620fb3 excel+0x3f4bb1 @ 0x2f814bb1
MdCallBack-0x8f811c excel+0x11da48 @ 0x2f53da48
MdCallBack-0x8f7e7a excel+0x11dcea @ 0x2f53dcea
MdCallBack-0x8ed92f excel+0x128235 @ 0x2f548235
MdCallBack-0x4e034f excel+0x535815 @ 0x2f955815
MdCallBack-0x4e041d excel+0x535747 @ 0x2f955747
MdCallBack-0x67d17e excel+0x3989e6 @ 0x2f7b89e6
MdCallBack-0xa0d6e1 excel+0x8483 @ 0x2f428483
MdCallBack-0xa0fd82 excel+0x5de2 @ 0x2f425de2
MdCallBack-0xa120c2 excel+0x3aa2 @ 0x2f423aa2
MdCallBack-0xa12378 excel+0x37ec @ 0x2f4237ec
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 3699308
registers.edi: 1953561104
registers.eax: 3699308
registers.ebp: 3699388
registers.edx: 0
registers.ebx: 8185724
registers.esi: 2147944122
registers.ecx: 2797098069
1 0 0
host 198.46.174.165
dead_host 198.46.174.165:80
Lionic Trojan.MSExcel.Generic.4!c
McAfee RDN/Generic Exploit
ALYac Exploit.MathType-Obfs.Gen
VIPRE Exploit.MathType-Obfs.Gen
Sangfor Exploit.Doc.CVE-2017-11882.b
Arcabit Exploit.MathType-Obfs.Gen
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Exp.CVE-2017-11882!g7
ESET-NOD32 probably a variant of Win32/Exploit.CVE-2017-11882.C
Avast OLE:CVE-2017-11882-B [Expl]
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.MathType-Obfs.Gen
MicroWorld-eScan Exploit.MathType-Obfs.Gen
Emsisoft Exploit.MathType-Obfs.Gen (B)
F-Secure Exploit.EXP/CVE-2017-11882.Gen
DrWeb Exploit.Siggen3.39044
McAfee-GW-Edition RDN/Generic Exploit
FireEye Exploit.MathType-Obfs.Gen
Sophos Troj/DocDl-AGUW
Ikarus Exploit.CVE-2017-11882
Avira EXP/CVE-2017-11882.Gen
MAX malware (ai score=85)
Antiy-AVL Trojan[Exploit]/Win32.CVE-2017-11882
Microsoft Trojan:Win32/Leonem
ZoneAlarm HEUR:Exploit.MSOffice.Generic
GData Exploit.MathType-Obfs.Gen
Google Detected
AhnLab-V3 Exploit/OLE.Cve-2017-11882.XG22
TACHYON Trojan-Exploit/W97.CVE-2017-11882
Zoner Probably Heur.W97NativeName
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Trojan.Mofer.bZu8xJ.4
Fortinet MSExcel/CVE_2017_11882.7584!exploit
AVG OLE:CVE-2017-11882-B [Expl]