Managed XDR

vtdl_masfdf_m — отчёт о динамическом анализе вредоносного файла

Информация о файле

Имя файла
vtdl_masfdf_m
Тип файла
MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=13, ctime=Mon Jan 1 00:00:00 1601, mtime=Mon Jan 1 00:00:00 1601, atime=Mon Jan 1 00:00:00 1601, length=0, window=hidenormalshowminimized
Размер файла
2.2 KB
Первое обнаружение
Последнее обнаружение

Окружение

win7/x86 en

Хеши

SHA1
975388cae907711501e17c59c6d98dc04bcc8b25
SHA256
c1c7d7fc93a617113ab4beeb1a3e1364d058a4a1e01c56f79ba30c8d5c258710
MD5
ec790650cfe53bfbf0fa8e4a885930cc

Сигнатуры

Execution

T1204 suspicious_lnk: LNK file with suspicious content
T1059.001 suspicious_powershell: Creates suspicious powershell process
T1059.001 suspicious_process: Spawns a suspicious process
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL

Discovery

T1518 locates_browser: Attempts to identify where browsers are installed

Other

yara_rules: Static rules
unexpected_exception: Unexpected exception
no_graphical_activity: No graphic activity
creates_suspended_process: Creates suspended process