Managed XDR

14b50000 — malware analysis report

File info

Filename
14b50000
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: wxm, Last Saved By: Bruno, Name of Creating Application: WPS Office, Create Time/Date: Fri Dec 2 08:54:00 2016, Last Saved Time/Date: Mon Jul 7 07:55:10 2025, Security: 0
File size
29 KB
First seen
Last seen

Environment

winxp/x86 en

Hashes

SHA1
89e509da9b8755a06b13a385ee4e0545b96ef866
SHA256
f8090611d6e6494cdf08d1fbfc627a5ab448d128e9d69fc2717729dd02e3439e
MD5
c2a3016c048b25c355fc05ef28d5e619

Signatures

Execution

T1203 office_exploit_crash: Microsoft Office process crashes (failed exploitation of a vulnerability is possible)
T1064 office_macros: The document contains macroses (total: 3)

Defense Evasion

T1064 office_macros: The document contains macroses (total: 3)

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Other

yara_rules: Static rules
modifies_certs: Attempts to generate or modify system certificates
office_summary: The document contains suspicious metadata
creates_in_programdata: Creates files in the ProgramData directory