Managed XDR

vtdl_1789946962_dc125li4 (ZLoader) — отчёт о динамическом анализе вредоносного файла

Информация о файле

Имя файла
vtdl_1789946962_dc125li4
Тип файла
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: xXx, Last Saved By: xXx, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jan 27 20:50:39 2022, Last Saved Time/Date: Thu Jan 27 21:01:17 2022, Security: 0
Размер файла
35.8 KB
Первое обнаружение
Последнее обнаружение

Окружение

w10/x64 en

Хеши

SHA1
b633fe3d2ea85a039a54f974896cb6e2d9f380f4
SHA256
29a9064f038631c5ad785ee2e97691cd3bbe85600fdafdd706c81c21a9314324
MD5
fe4e94c5721504a55a61b271bcddb550

Вредоносное ПО

  • ZLoader

Сигнатуры

Execution

T1064 office_macros_hidden: Document contains suspicious Excel 4.0 macro
T1064 office_macros_suspicious: Document contains suspicious macro
T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_strings: Feature lines found in document macro

Defense Evasion

T1064 office_macros_hidden: Document contains suspicious Excel 4.0 macro
T1064 office_macros_suspicious: Document contains suspicious macro
T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_strings: Feature lines found in document macro

Other

yara_rules: Static rules
no_graphical_activity: No graphic activity
office_summary: The document contains suspicious metadata

Похожие отчёты