Managed XDR

16a1c413f0d1a35b9fad3e45ced033fa.wps (Cobalt Strike) — отчёт о динамическом анализе вредоносного файла

Информация о файле

Имя файла: 16a1c413f0d1a35b9fad3e45ced033fa.wps
Тип файла: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1200, Author: yangya, Template: Normal, Last Saved By: yangya, Revision Number: 1, Total Editing Time: Thu Jan 11 00:00:00 1900, Create Time/Date: Wed Oct 29 14:47:00 2025, Last Saved Time/Date: Wed Oct 29 14:59:44 2025, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: WPS , Security: 0, Locale ID: 2052
Размер файла: 19 KB
Первое обнаружение: 2025-10-29 08:04
Последнее обнаружение: 2025-10-29 08:04

w10/x86 en

T1204.002 office_com_load: Microsoft Office loads COM DLL files (indicator of COM usage in macros)

T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

yara_rules: Static rules

office_summary: The document contains suspicious metadata

test_check_service: Starts services

writes_data: Writes big amount of data to disk