Report - 1019_7169909343268.doc

VBA_macro Generic Malware MSOffice File
ScreenShot
Created 2021.10.20 16:30 Machine s1_win7_x6401
Filename 1019_7169909343268.doc
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Auth
AI Score Not founds Behavior Score
3.0
ZERO API file : clean
VT API (file) 25 detected (Valyria, Eldorado, Malicious, score, MRAHJ, ASMacro, ai score=81, Probably Heur, W97Obfuscated)
md5 4e062eb96bf086392a2a33f0f2dd7e69
sha256 29c4d9f88f26a2a929b980571cdabab0185bdc0b926fd1dd9fb38489ba6a4306
ssdeep 12288:o8CmEKY7gpWMBueoM6scG2u302l0HwbsG7kWunEDXm/zjH0Bk:o8CmEj6BuTMDn2u3049HSn+Xm/v
imphash
impfuzzy
  Network IP location

Signature (6cnts)

Level Description
warning File has been identified by 25 AntiVirus engines on VirusTotal as malicious
watch Libraries known to be associated with a CVE were requested (may be False Positive)
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates (office) documents on the filesystem
notice Creates hidden or system file
notice Word document hooks document open

Rules (3cnts)

Level Name Description Collection
warning Contains_VBA_macro_code Detect a MS Office document with embedded VBA macro code [binaries] binaries (upload)
warning Generic_Malware_Zero Generic Malware binaries (upload)
info Microsoft_Office_File_Zero Microsoft Office File binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure