Managed XDR

r2hk76x.ppt — malware analysis report

File info

Filename
r2hk76x.ppt
File type
Composite Document File V2 Document, Little Endian, Os: MacOS, Version 10.3, Code page: 10000, Title: Optimizers, Last Saved By: Thomas Tylutki, Revision Number: 1, Name of Creating Application: Microsoft Macintosh PowerPoint, Last Saved Time/Date: Wed Jun 13 12:50:58 2012, Number of Pages: 0, Number of Words: 2128, Number of Characters: 0
File size
3.3 MB
First seen
Last seen

Environment

winxp/x86 en

Hashes

SHA1
3dbe63e63bc4b7832143a5c90a6e75e4a152be63
SHA256
10f49d67f0ff7cb1ebc5c80c133ad08789b6c3c72f7bf7f879664c2146bb149f
MD5
e01d12844f4c87be7154ed0c3e199d47

Signatures

Privilege Escalation

T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
office_summary: The document contains suspicious metadata
creates_in_programdata: Creates files in the ProgramData directory