Managed XDR

chapter-iv-multiple-integral-2673-.doc — malware analysis report

File info

Filename
chapter-iv-multiple-integral-2673-.doc
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: -535, Title: Chapter III, Author: user01, Template: Normal, Last Saved By: Temesgen Abera Gebru, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Last Printed: Sat Jul 18 19:22:00 2009, Create Time/Date: Mon Jan 27 09:51:00 2025, Last Saved Time/Date: Mon Jan 27 09:51:00 2025, Number of Pages: 26, Number of Words: 6730, Number of Characters: 38365, Security: 0
File size
1 MB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
d013a4bb486820bfbf5005bae6c528ad5905ab3c
SHA256
3d379cf0685e2bb73f9621e097d0d251e19653a543527cd9b374be8840a5b87a
MD5
4cb4d921679df397a85d1ebf06cfb301

Signatures

Execution

T1203 exploit_CVE_2017_11882: Exploits CVE-2017-11882 vulnerability
T1204.002 office_vb_load: Microsoft Office is loading VB DLL files (macros usage indicator)
T1204.002 office_com_load: Microsoft Office loads COM DLL files (indicator of COM usage in macros)
T1064 office_macros: The document contains macro

Defense Evasion

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1064 office_macros: The document contains macro

Discovery

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1083 checks_recent_files: Attempt to check recently opened files through registry

Command and Control

T1071.001 network_http: Performs HTTP requests
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Other

dead_host: Connects to IP addresses that do not respond to requests
process_crashed: One of the processes has failed
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process
test_check_service: Starts services
yara_rules: Static rules