Report - 7ebfba0b98c135481c14db1c2f2da484.docm

VBA_macro AntiDebug AntiVM Word 2007 file format(docx) ZIP Format Lnk Format GIF Format
ScreenShot
Created 2024.07.18 10:54 Machine s1_win7_x6402
Filename 7ebfba0b98c135481c14db1c2f2da484.docm
Type Microsoft Word 2007+
AI Score Not founds Behavior Score
10.0
ZERO API file : clean
VT API (file) 23 detected (malicious, high confidence, score, EmoooDldr, Save, Kimsuky, Obfuscated, Valyria, Dnldr, elyanu, PBMD, modification of W97M, Detected, ai score=82)
md5 7ebfba0b98c135481c14db1c2f2da484
sha256 d79f4ac802c50c40ecdba1aa505ed08e489524d23f7e30cce8599dbf9fcbf520
ssdeep 12288:MYsBqz0FqGrhN0kKZU3VziFhhMs2G3v0ZemkfdA45/khhMs2G3v0ZemkfdA45/v:oqz0FqGNevm35uhhMA8ZEfzFkhhMA8Z+
imphash
impfuzzy
  Network IP location

Signature (20cnts)

Level Description
danger The processes winword.exe
warning File has been identified by 23 AntiVirus engines on VirusTotal as malicious
watch A command shell or script process was created by an unexpected parent process
watch Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe
watch One or more non-whitelisted processes were created
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch Wscript.exe initiated network communications indicative of a script based payload download
watch wscript.exe-based dropper (JScript
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice An application raised an exception which may be indicative of an exploit crash
notice Creates (office) documents on the filesystem
notice Creates a shortcut to an executable file
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Creates hidden or system file
notice Performs some HTTP requests
notice Yara rule detected in process memory
info Checks amount of memory in system
info One or more processes crashed

Rules (14cnts)

Level Name Description Collection
warning Contains_VBA_macro_code Detect a MS Office document with embedded VBA macro code [binaries] binaries (upload)
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info docx Word 2007 file format detection binaries (upload)
info lnk_file_format Microsoft Windows Shortcut File Format binaries (download)
info Lnk_Format_Zero LNK Format binaries (download)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info zip_file_format ZIP file format binaries (upload)
info test_office test url scripts

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://koreaillmin.mypressonline.com/file/upload/list.php?query=1 BG Zetta Hosting Solutions LLC. 185.176.43.98 clean
koreaillmin.mypressonline.com BG Zetta Hosting Solutions LLC. 185.176.43.98 clean
185.176.43.98 BG Zetta Hosting Solutions LLC. 185.176.43.98 mailcious

Suricata ids



Similarity measure (PE file only) - Checking for service failure