Managed XDR

vtdl_r93a7ggk — malware analysis report

File info

Filename
vtdl_r93a7ggk
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=322, Archive, ctime=Fri Jul 10 10:59:58 2015, mtime=Fri Jul 10 10:59:58 2015, atime=Fri Jul 10 10:59:58 2015, length=74240, window=hide
File size
2.3 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
d12e6f4f9437caafca586ed34d087991609e09d1
SHA256
b21c5d950a9fafefd9fbc229e091852649c9256a2dc461f67cdbe1758ecd8888
MD5
23396e2a23572908cd415fb787563bbe

Signatures

Execution

T1204 suspicious_lnk: LNK file with suspicious content
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL

Persistence

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup

Privilege Escalation

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup

Defense Evasion

T1218 suspicious_cmdline: Executes a suspicious command

Other

yara_rules: Static rules
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process