Managed XDR

vtdl_7xiyf4k9 — malware analysis report

File info

Filename
vtdl_7xiyf4k9
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: PowerPoi, Author: mw, Template: Edg, Last Saved By: o(, Revision Number: 38, Total Editing Time: 4d+05:02:01, Create Time/Date: Thu Jul 21 00:15:18 2005, Last Saved Time/Date: Tue Jun 23 17:21:45 2020, Number of Words: 0, Name of Creating Application: Microsoft P
File size
4.1 MB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
78a6b1093e4c5b2865bffb3a64dab839bb4c3115
SHA256
2bc02fcae13e54480da7ebeda181e710fd01551af1909a93844f5e22ae43993e
MD5
451f1e25b842a98909a586c7266b8f5c

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
office_summary: The document contains suspicious metadata
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card