Managed XDR

vtdl_1789946962_dc125li4 (ZLoader) — malware analysis report

File info

Filename
vtdl_1789946962_dc125li4
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: xXx, Last Saved By: xXx, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jan 27 20:50:39 2022, Last Saved Time/Date: Thu Jan 27 21:01:17 2022, Security: 0
File size
35.8 KB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
b633fe3d2ea85a039a54f974896cb6e2d9f380f4
SHA256
29a9064f038631c5ad785ee2e97691cd3bbe85600fdafdd706c81c21a9314324
MD5
fe4e94c5721504a55a61b271bcddb550

Malwares

  • ZLoader

Signatures

Execution

T1064 office_macros_hidden: Document contains suspicious Excel 4.0 macro
T1064 office_macros_suspicious: Document contains suspicious macro
T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_strings: Feature lines found in document macro

Defense Evasion

T1064 office_macros_hidden: Document contains suspicious Excel 4.0 macro
T1064 office_macros_suspicious: Document contains suspicious macro
T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_strings: Feature lines found in document macro

Other

yara_rules: Static rules
no_graphical_activity: No graphic activity
office_summary: The document contains suspicious metadata

Related reports