Managed XDR

vtdl_1738718079_kh1s4n2k — malware analysis report

File info

Filename
vtdl_1738718079_kh1s4n2k
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Title: PowerPoint Presentation, Author: Dhanapal N., Last Saved By: Pavish Gowtham S(Pavish Gowtham S)/GET/Plant HR India.HR Planning/MAIL, Revision Number: 965, Name of Creating Application: Microsoft Office PowerPoint, Total Editing Time: 8d+11:01:11, Last Printed: Mon Jul 4 08:57:57 2022, Create Time/Date: Tue Nov 20 09:25:15 2018, Last Saved Time/Date: Mon Feb 3 11:45:36 2025, Number of Words: 267
File size
27.8 MB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
33a6676cf28ee501e85ce7c6cc8b4e8c5c4c8da9
SHA256
5df842ff4199cc8fdf07fdfa621f48a7929f8d1b023a4068fbe03e2507b75608
MD5
4c97a89d02ea9afc83bf451bcf498645

Signatures

Execution

T1064 office_macros_autoexec: The document contains an auto-start macro

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1064 office_macros_autoexec: The document contains an auto-start macro
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1083 checks_recent_files: Attempt to check recently opened files through registry

Other

yara_rules: Static rules
office_summary: The document contains suspicious metadata
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card