Report - ZeroBOX

ScreenShot

Info
Location map


Created	2021.03.18 08:45	Machine	s1_win7_x6401
Filename	[Content_Types].xml
Type	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
AI Score	Not founds	Behavior Score	4.2
ZERO API	file : clean
VT API (file)
md5	2d7389509248f6fbf029f1ef6de3b7a9
sha256	b2ea870f36d854479a33ce8a8ec8c9ec0f19cca5db3884c7c9d5047caf5d5a42
ssdeep	48:ciZIsWAI8q2+C2+mDIsO2+jR2+9G2+aIsW2++IstW2+8YIstF2+b7Ish2+b2Ish3:BZIKI8qpCpmDILpjRp9GpaI/p+IaWpj6
imphash
impfuzzy

Network IP location

Signature (10cnts)

Level	Description
watch	Communicates with host for which no DNS query was performed
watch	Resumed a suspended thread in a remote process potentially indicative of process injection
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	An application raised an exception which may be indicative of an exploit crash
notice	Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice	Performs some HTTP requests
notice	Potentially malicious URLs were found in the process memory dump
notice	Uses Windows utilities for basic Windows functionality
notice	Yara rule detected in process memory
info	One or more processes crashed

Rules (46cnts)

Level	Name	Description	Collection
notice	Str_Win32_Http_API	Match Windows Http API call	memory
notice	Str_Win32_Internet_API	Match Windows Inet API call	memory
info	anti_dbg	Checks if being debugged	memory
info	antisb_threatExpert	Anti-Sandbox checks for ThreatExpert	memory
info	Check_Dlls	(no description)	memory
info	DebuggerCheck__GlobalFlags	(no description)	memory
info	DebuggerCheck__QueryInfo	(no description)	memory
info	DebuggerCheck__RemoteAPI	(no description)	memory
info	DebuggerException__ConsoleCtrl	(no description)	memory
info	DebuggerException__SetConsoleCtrl	(no description)	memory
info	DebuggerHiding__Active	(no description)	memory
info	DebuggerHiding__Thread	(no description)	memory
info	disable_dep	Bypass DEP	memory
info	SEH__vectored	(no description)	memory
info	ThreadControl__Context	(no description)	memory
info	win_hook	Affect hook table	memory
info	create_com_service	Create a COM server	memory
info	create_service	Create a windows service	memory
info	cred_local	Steal credential	memory
info	escalate_priv	Escalade priviledges	memory
info	hijack_network	Hijack network configuration	memory
info	inject_thread	Code injection with CreateRemoteThread in a remote process	memory
info	keylogger	Run a keylogger	memory
info	Microsoft_Office_Document_Zero	Microsoft Office Document Signature Zero	binaries (download)
info	migrate_apc	APC queue tasks migration	memory
info	network_dga	Communication using dga	memory
info	network_dns	Communications use DNS	memory
info	network_dropper	File downloader/dropper	memory
info	network_ftp	Communications over FTP	memory
info	network_http	Communications over HTTP	memory
info	network_p2p_win	Communications over P2P network	memory
info	network_tcp_listen	Listen for incoming communication	memory
info	network_tcp_socket	Communications over RAW socket	memory
info	network_toredo	Communications over Toredo network	memory
info	network_udp_sock	Communications over UDP network	memory
info	screenshot	Take screenshot	memory
info	sniff_audio	Record Audio	memory
info	spreading_file	Malware can spread east-west file	memory
info	spreading_share	Malware can spread east-west using share drive	memory
info	Str_Win32_Wininet_Library	Match Windows Inet API library declaration	memory
info	Str_Win32_Winsock2_Library	Match Winsock 2 API library declaration	memory
info	win_files_operation	Affect private profile	memory
info	win_mutex	Create or check mutex	memory
info	win_private_profile	Affect private profile	memory
info	win_registry	Affect system registries	memory
info	win_token	Affect system token	memory

Network (0cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?

Report - [Content_Types].xml

Signature (10cnts)

Rules (46cnts)

Network (0cnts) ?

Suricata ids

Similarity measure (PE file only) - Checking for service failure