Managed XDR

vtdl__2fobkf1 — malware analysis report

File info

Filename
vtdl__2fobkf1
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: VNN.R9, Last Saved By: VNN.R9, Name of Creating Application: Microsoft Excel, Last Printed: Tue Jan 17 08:59:51 2023, Create Time/Date: Sat Apr 2 16:55:06 2005, Last Saved Time/Date: Tue Feb 20 03:37:04 2024, Security: 1
File size
1.4 MB
First seen
Last seen

Environment

winxp/x86 en

Hashes

SHA1
0824964ba2beaef6b5482c2d245c2d65d4f2364b
SHA256
cf252eabdbeb53979256310bdfe36c1da03962a39e933da21d73e57190cb1b2d
MD5
2cd53202b92dba52c432f15660b5bbfe

Signatures

Execution

T1064 office_macros_hidden: Document contains suspicious Excel 4.0 macro
T1064 office_macros: The document contains macro
T1064 office_macros_autoexec: The document contains an auto-start macro

Privilege Escalation

T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1064 office_macros_hidden: Document contains suspicious Excel 4.0 macro
T1064 office_macros: The document contains macro
T1064 office_macros_autoexec: The document contains an auto-start macro
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
office_summary: The document contains suspicious metadata
creates_in_programdata: Creates files in the ProgramData directory