popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

INVESTIGATION_OF_SEXUAL_HARASSMENT.docx

Word 2007 file format(docx) ZIP Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 8, 2024, 2:07 p.m. July 8, 2024, 2:09 p.m.
Size 1.4MB
Type Microsoft OOXML
MD5 9345d52abd5bab4320c1273eb2c90161
SHA256 b72ac58d599e6e1080251b1ac45a521b33c08d7d129828a4e82a7095e9f93e53
CRC32 F3A6DC49
ssdeep 24576:VoNQ1+/W3rFh9SgVD3rhsIcll1VjjSfeKLTnrvSOJh+zu8vOuW4ZhlQK9Wd:VoNQKW3rFh9l2hlHHBKLbrvhUiCOuWAK
Yara
  • zip_file_format - ZIP file format
  • docx - Word 2007 file format detection

Name Response Post-Analysis Lookup
investigation04.session-out.com
A 89.150.40.43
89.150.40.43
x1.i.lencr.org
CNAME crl.root-x1.letsencrypt.org.edgekey.net
CNAME e8652.dscx.akamaiedge.net
A 23.41.113.9
23.52.33.11
IP Address Status Action
164.124.101.2 Active Moloch
23.41.113.9 Active Moloch
89.150.40.43 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49165 -> 89.150.40.43:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49162 -> 89.150.40.43:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49167 -> 89.150.40.43:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49165
89.150.40.43:443 		C=US, O=Let's Encrypt, CN=R11 CN=*.session-out.com 52:ef:0a:05:6a:3d:2b:7c:d3:af:dd:15:76:7f:18:1b:44:f4:24:9a
TLSv1
192.168.56.102:49162
89.150.40.43:443 		C=US, O=Let's Encrypt, CN=R11 CN=*.session-out.com 52:ef:0a:05:6a:3d:2b:7c:d3:af:dd:15:76:7f:18:1b:44:f4:24:9a
TLSv1
192.168.56.102:49167
89.150.40.43:443 		None None None

request GET http://x1.i.lencr.org/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 3032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6a20a000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\~$VESTIGATION_OF_SEXUAL_HARASSMENT.docx
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000454
filepath: C:\Users\test22\AppData\Local\Temp\~$VESTIGATION_OF_SEXUAL_HARASSMENT.docx
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$VESTIGATION_OF_SEXUAL_HARASSMENT.docx
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
Kaspersky HEUR:Trojan-Downloader.MSOffice.Dotmer.gen
NANO-Antivirus Exploit.Xml.CVE-2017-0199.equmby
ZoneAlarm HEUR:Trojan-Downloader.MSOffice.Dotmer.gen
Zoner Probably Heur.W97OleLink