Managed XDR

vtdl_1789949552_tw2078i6 (ZLoader) — malware analysis report

File info

Filename
vtdl_1789949552_tw2078i6
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: xXx, Last Saved By: xXx, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Jan 26 14:19:06 2022, Last Saved Time/Date: Wed Jan 26 16:22:12 2022, Security: 0
File size
105 KB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
afb5fd07a8c0adb3befb10faa4b9c4be99c4d7f5
SHA256
a83fdd736909ffa8a4f34aba22b3807a1ffb165fe9f54d3d84563b66f3b5f3d9
MD5
e73daf9ee168bf096a2b1aaf705cb2d5

Malwares

  • ZLoader

Signatures

Execution

T1064 office_macros_hidden: Document contains suspicious Excel 4.0 macro
T1064 office_macros_suspicious: Document contains suspicious macro
T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_strings: Feature lines found in document macro

Defense Evasion

T1064 office_macros_hidden: Document contains suspicious Excel 4.0 macro
T1064 office_macros_suspicious: Document contains suspicious macro
T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_strings: Feature lines found in document macro

Other

yara_rules: Static rules
no_graphical_activity: No graphic activity
office_summary: The document contains suspicious metadata

Related reports