Report - de2fd62fafe61f46ad967c84dd7fbca80d31ad4729fed051d527d9ba45857fd6

VBA_macro Generic Malware AntiDebug AntiVM MSOffice File
ScreenShot
Created 2023.09.08 17:20 Machine s1_win7_x6401
Filename de2fd62fafe61f46ad967c84dd7fbca80d31ad4729fed051d527d9ba45857fd6
Type Composite Document File V2 Document, Cannot read section info
AI Score Not founds Behavior Score
4.2
ZERO API file : clean
VT API (file) 35 detected (SAgent, malicious, high confidence, score, Valyria, Save, Eldorado, CodeLoader, CLASSIC, udrmb, OLE2, Kimsuky, S1649, ai score=100, Static AI, Malicious OLE)
md5 f282875b9958bd3706f9063bf8c5bf14
sha256 de2fd62fafe61f46ad967c84dd7fbca80d31ad4729fed051d527d9ba45857fd6
ssdeep 384:pZSSBM46QLwAc0Le5fGbMUN0j1ZH4Tpth34WvJo7/F46y:Nfj9e5fGb7KZHNWvJob+
imphash
impfuzzy
  Network IP location

Signature (9cnts)

Level Description
danger File has been identified by 35 AntiVirus engines on VirusTotal as malicious
watch Attempts to modify browser security settings
watch Harvests credentials from local email clients
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Tries to locate where the browsers are installed

Rules (11cnts)

Level Name Description Collection
warning Contains_VBA_macro_code Detect a MS Office document with embedded VBA macro code [binaries] binaries (upload)
warning Generic_Malware_Zero Generic Malware binaries (upload)
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info Microsoft_Office_File_Zero Microsoft Office File binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure