Managed XDR

vtdl_1752119145_yh5cxvr0 — malware analysis report

File info

Filename
vtdl_1752119145_yh5cxvr0
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 936, Title: SOCIETE GENERALE, Author: jack, Template: Normal.dot, Last Saved By: SOCIETE GENERALE, Revision Number: 3, Name of Creating Application: Microsoft Word 10.0, Total Editing Time: 03:00, Last Printed: Tue Feb 10 06:13:00 2009, Create Time/Date: Tue Feb 10 06:18:00 2009, Last Saved Time/Date: Tue Feb 24 07:59:00 2009, Number of Pages: 1, Number of Words: 197, Number of Characters: 1125, Security: 0
File size
2.6 MB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
ed09c174730f1a088a97dc114ecff7de18bf6b1e
SHA256
bd78abfbe85e13bd0e49665f273a7a9f431f49823608a8bf4ceb2396c786cd9c
MD5
2a7e43b8c181ef8b9bb16d018616cf9b

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1083 checks_recent_files: Attempt to check recently opened files through registry
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents

Other

yara_rules: Static rules
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card