Loading... Additional Content is being loaded
Windows Analysis Report 4TWEQh2HJb
Overview
General Information
| Sample Name: | 4TWEQh2HJb (renamed file extension from none to xls) |
| Analysis ID: | 448885 |
| MD5: | 40425d09e54ff26289dd074649f0cad9 |
| SHA1: | ae7e4df26092d9acf01b732c8144f0170ccc6556 |
| SHA256: | 6f8f1b26324ea0f3f566fbdcb4a61eb92d054ccf0300c52b3549c774056b8f02 |
| Tags: | excelxlsx |
| Infos: | |
|
Most interesting Screenshot:  |
|
Detection
Dridex
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Document exploit detected (creates forbidden files)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (process start blacklist hit)
Machine Learning detection for dropped file
Machine Learning detection for sample
Microsoft Office creates scripting files
Sigma detected: Microsoft Office Product Spawning Windows Shell
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Tries to detect virtualization through RDTSC time measurements
Uses known network protocols on non-standard ports
Abnormal high CPU Usage
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Uses code obfuscation techniques (call, push, ret)
Classification
AV Detection: |
  |
|---|
| Found malware configuration |
| Source: |
Malware Configuration Extractor: |
||
| Multi AV Scanner detection for dropped file |
| Source: |
ReversingLabs: |
||
| Multi AV Scanner detection for submitted file |
| Source: |
Virustotal: |
Perma Link | ||
| Machine Learning detection for dropped file |
| Source: |
Joe Sandbox ML: |
||
| Machine Learning detection for sample |
| Source: |
Joe Sandbox ML: |
||
| Antivirus or Machine Learning detection for unpacked file |
| Source: |
Avira: |
||
Compliance: |
|
|---|
| Detected unpacking (overwrites its own PE header) |
| Source: |
Unpacked PE file: |
||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
Software Vulnerabilities: |
|
|---|
| Document exploit detected (creates forbidden files) |
| Source: |
File created: |
Jump to behavior | ||
| Document exploit detected (process start blacklist hit) |
| Source: |
Process created: |
||
| Potential document exploit detected (performs DNS queries) |
| Source: |
DNS query: |
||
| Potential document exploit detected (performs HTTP gets) |
| Source: |
TCP traffic: |
||
| Potential document exploit detected (unknown TCP traffic) |
| Source: |
TCP traffic: |
||
Networking: |
|
|---|
| C2 URLs / IPs found in malware configuration |
| Source: |
IPs: |
||
| Source: |
IPs: |
||
| Source: |
IPs: |
||
| Uses known network protocols on non-standard ports |
| Source: |
Network traffic detected: |
||
| Source: |
Network traffic detected: |
||
| Detected TCP or UDP traffic on non-standard ports |
| Source: |
TCP traffic: |
||
| Downloads executable code via HTTP |
| Source: |
HTTP traffic detected: | ||