Report - Invoice_730621.xls

Dridex VBA_macro MSOffice File PE32 DLL PE File
ScreenShot
Created 2021.07.22 11:11 Machine s1_win7_x6403
Filename Invoice_730621.xls
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title
AI Score Not founds Behavior Score
3.4
ZERO API file : mailcious
VT API (file) 15 detected (malicious, high confidence, Dridex, CVE-2017-8570, Ole2, druvzi, ai score=88, Probably Heur, W97ShellB, obfuscated)
md5 15d1252024d046b76737f80017b31b5e
sha256 4a8c152ef7c7e3ced93e8629691f6f66bb67f78c4e17caf0198db18300b19acf
ssdeep 6144:N0Y35qAOJl/YrLYz+WrNhZF+E+W2RGtpPjKBbA2G0VeU+fMGM9yhy1Ck/ug14z:GjwbA2EfK3
imphash
impfuzzy
  Network IP location

Signature (8cnts)

Level Description
watch File has been identified by 15 AntiVirus engines on VirusTotal as malicious
watch One or more non-whitelisted processes were created
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice One or more potentially interesting buffers were extracted
info Checks amount of memory in system

Rules (6cnts)

Level Name Description Collection
danger Win32_Trojan_Dridex_Gene_Zero Win32 Trojan Dridex Gene binaries (download)
warning Contains_VBA_macro_code Detect a MS Office document with embedded VBA macro code [binaries] binaries (upload)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info Microsoft_Office_File_Zero Microsoft Office File binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://taskremindment.com:8088/css/b486Pv.png US CLEAR-RATE-COMMUNICATIONS 208.83.69.35 3113 clean
taskremindment.com SG DIGITALOCEAN-ASN 128.199.243.169 malware
128.199.243.169 SG DIGITALOCEAN-ASN 128.199.243.169 malware

Suricata ids



Similarity measure (PE file only) - Checking for service failure