Report - facts.08.21.doc

AntiDebug AntiVM
ScreenShot
Created 2021.08.03 09:34 Machine s1_win7_x6403
Filename facts.08.21.doc
Type XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
AI Score Not founds Behavior Score
6.2
ZERO API file : clean
VT API (file) 20 detected (malicious, high confidence, Valyria, Trickbot, Ole2, druvzi, Siggen3, ai score=82, Woreflint, qexvmc)
md5 97d717e44f8f2faf01af69a10886718a
sha256 5cd0951a1172d5b029f180da1d44826bb6ca117acf15df52671464038114455f
ssdeep 1536:EYnb1puKpoQHr11AQYyqGJHQYCDEtU6dLTR97AL4Lhuw200pZpOA151rzbxaDYbb:LbJoSxQYNtU6ZvAL4Lhuw27zpOA15ZzD
imphash
impfuzzy
  Network IP location

Signature (13cnts)

Level Description
warning File has been identified by 20 AntiVirus engines on VirusTotal as malicious
watch A command shell or script process was created by an unexpected parent process
watch Disables proxy possibly for traffic interception
watch One or more non-whitelisted processes were created
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Creates (office) documents on the filesystem
notice Creates a suspicious process
notice Creates hidden or system file
notice Performs some HTTP requests
notice Yara rule detected in process memory
info Checks amount of memory in system

Rules (8cnts)

Level Name Description Collection
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://camachovioling.com/bdfh/42817/nTaQuD3SzLsSBS6e12bKPSrNtt5cVpQkENVZDd2ykLqRI2N/8nAUDRaaEuSYL/O4x/9UCY8heIznFmAqMSL9VJcMVUuZ8RI2py/4tSZYzuPskqnmIhk3b8VlIASCLKpFkb/RZA5jM9CbEbkqanyvrX9o4Esy9FjYfJ47u3zVsm9UeR/q/H8RkWViGdVNkvH5Dfmoqq/3vcqms45GLbESn9NhL4 Unknown 45.95.11.132 mailcious
camachovioling.com Unknown 45.95.11.132 mailcious
45.95.11.132 Unknown 45.95.11.132 mailcious

Suricata ids



Similarity measure (PE file only) - Checking for service failure