Managed XDR

permanent-contact-info.xls — malware analysis report

File info

Filename
permanent-contact-info.xls
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 936, Title: , Last Saved By: qq, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Dec 17 01:32:42 1996, Last Saved Time/Date: Thu Nov 26 03:35:15 2009, Security: 0
File size
25.5 KB
First seen
Last seen

Environment

winxp/x86 en

Hashes

SHA1
49d712bd3bcb30e9913f1734edde7b8478c54ed0
SHA256
6ca8c199be3b78d4654400acdfd653bffceeffb3a96a21e80aaefec16f3ac828
MD5
407042404728813802752d04dd365969

Signatures

Execution

T1203 office_exploit_crash: Microsoft Office process crashes (failed exploitation of a vulnerability is possible)
T1064 office_macros: The document contains macro

Defense Evasion

T1064 office_macros: The document contains macro

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Other

yara_rules: Static rules
modifies_certs: Attempts to generate or modify system certificates
office_summary: The document contains suspicious metadata
creates_in_programdata: Creates files in the ProgramData directory