Managed XDR

vtdl_u64vx884 — malware analysis report

File info

Filename
vtdl_u64vx884
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.10, Code page: 1252, Title: ', Author: (C) 1995-1998 Microsoft Corporation, Comments: ATP Dialog Resource Sheets, Last Saved By: Microsoft Corp, Create Time/Date: Thu Dec 21 23:37:39 1995, Last Saved Time/Date: Thu Jan 21 08:11:00 1999, Security: 0
File size
99.5 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
ea9a90608d215d1c5bc84dc4853307bd4cd2490f
SHA256
8833681128513c5f5e7543525757c91d5ad1601d6809a12ef8209b077e2331cd
MD5
ee1c6ea9ecdf7c96d914cc1499f4de8e

Signatures

Execution

T1064 office_macros_hidden: Document contains suspicious Excel 4.0 macro
T1064 office_macros: The document contains macroses (total: 3)
T1064 office_macros_autoexec: The document contains an auto-start macro

Defense Evasion

T1064 office_macros_hidden: Document contains suspicious Excel 4.0 macro
T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1064 office_macros: The document contains macroses (total: 3)
T1064 office_macros_autoexec: The document contains an auto-start macro

Discovery

T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1082 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining

Other

yara_rules: Static rules
get_memory_status: Gets information about the virtual and physical memory of the system
office_summary: The document contains suspicious metadata
get_sid_domain: Get user's SID
get_username: Gets username
test_check_service: Starts services
create_rpc_bindings: Creates RPC connection