Managed XDR

bbb67f8c50cd36743e2b98...38c51c919cf2ec8c8e.ppt — malware analysis report

File info

Filename
bbb67f8c50cd36743e2b98ba96e6df226aa49e38c51c919cf2ec8c8e.ppt
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: Effective Tax Ra, Author: Bethany.MILLAR-P, Last Saved By: Bethany.MILLAR-P, Revision Number: 76, Total Editing Time: 10d+00:37:15, Last Printed: Tue Dec 4 13:22:55 2018, Create Time/Date: Thu Oct 25 13:58:24 2018, Last Saved Time/Date: Mon Jul 22 10:06:49 2024, Number of Words: 0, Name of Creating Application: Microsoft Offi
File size
1.1 MB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
c21f18b50b7e33677b6e7f3d161977574af9ff4f
SHA256
09a76320fa10787354bedb66a9ee825ad4afa75ca8a24d9ae098db1385790536
MD5
fdaddd73dcf6aed4a147b50a30d7b85c

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
office_summary: The document contains suspicious metadata
get_policy_info: Retrieves information about a Policy object
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card