Report - ZeroBOX

ScreenShot


Created	2021.03.03 09:10	Machine	s1_win7_x6401
Filename	BANK TRANSFER CONFIRMATION RECEIPT IN ATTACHMENT.docx
Type	Microsoft Word 2007+
AI Score	Not founds	Behavior Score	3.0
ZERO API	file : malware
VT API (file)	9 detected (Hmhm, Outbreak, HjcASQAA)
md5	201a45a33e877324be58f5541fef9011
sha256	0652962c5dace16ed170a932e3ce7eb3097b34bc809343fbb96b27cf3d22a5c7
ssdeep	384:Q3CZQ62G0cHrsozpn0i13LEAvDPtbYt0q9tHlxxnEIs2W9LY7k40ldng+XaUNnn:Q3KT0cH9pv13DodlnE00L4n0DbKm
imphash
impfuzzy

Network IP location

Level	Description
watch	Libraries known to be associated with a CVE were requested (may be False Positive)
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Creates (office) documents on the filesystem
notice	Creates hidden or system file
notice	File has been identified by 9 AntiVirus engines on VirusTotal as malicious
notice	Potentially malicious URLs were found in the process memory dump
notice	Yara rule detected in process memory

Level	Name	Description	Collection
notice	Str_Win32_Http_API	Match Windows Http API call	memory
notice	Str_Win32_Internet_API	Match Windows Inet API call	memory
info	anti_dbg	Checks if being debugged	memory
info	antisb_threatExpert	Anti-Sandbox checks for ThreatExpert	memory
info	DebuggerCheck__QueryInfo	(no description)	memory
info	ThreadControl__Context	(no description)	memory
info	win_hook	Affect hook table	memory
info	create_com_service	Create a COM server	memory
info	cred_local	Steal credential	memory
info	escalate_priv	Escalade priviledges	memory
info	keylogger	Run a keylogger	memory
info	migrate_apc	APC queue tasks migration	memory
info	network_dga	Communication using dga	memory
info	network_dns	Communications use DNS	memory
info	network_ftp	Communications over FTP	memory
info	network_http	Communications over HTTP	memory
info	network_tcp_listen	Listen for incoming communication	memory
info	network_tcp_socket	Communications over RAW socket	memory
info	OleStream	(no description)	scripts
info	rat_rdp	Remote Administration toolkit enable RDP	memory
info	screenshot	Take screenshot	memory
info	spreading_file	Malware can spread east-west file	memory
info	Str_Win32_Wininet_Library	Match Windows Inet API library declaration	memory
info	Str_Win32_Winsock2_Library	Match Winsock 2 API library declaration	memory
info	win_files_operation	Affect private profile	memory
info	win_mutex	Create or check mutex	memory
info	win_private_profile	Affect private profile	memory
info	win_registry	Affect system registries	memory
info	win_token	Affect system token	memory

Request	CC	ASN Co	IP4	Rule ?	ZERO ?

Report - BANK TRANSFER CONFIRMATION RECEIPT IN ATTACHMENT.docx