Play interactive tour
Edit tourWindows Analysis Report attacker5.doc
Overview
General Information
| Sample Name: | attacker5.doc |
| Analysis ID: | 522199 |
| MD5: | 4ac3d0835c1650e2ec73c8607d55ed1d |
| SHA1: | ad6ebde97a0f082cfc812f5f99ecb83b0c4caf4b |
| SHA256: | 55c9ff8f829bf0d5bbec83127570ad149bd18bc0351c59933090af917b4451db |
| Infos: | |
Most interesting Screenshot:  | |
Detection
Metasploit
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Yara detected MetasploitPayload
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Malicious encrypted Powershell command line found
Antivirus detection for dropped file
Document contains an embedded VBA macro which may execute processes
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Microsoft Office Product Spawning Windows Shell
Encrypted powershell cmdline option found
Very long command line found
Suspicious powershell command line found
Machine Learning detection for sample
Sigma detected: Suspicious PowerShell Cmdline
Document contains an embedded VBA macro with suspicious strings
Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines
Document exploit detected (process start blacklist hit)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Document has an unknown application name
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document misses a certain OLE stream usually present in this Microsoft Office document type
Contains long sleeps (>= 3 min)
Enables debug privileges
Document contains no OLE stream with summary information
Potential document exploit detected (unknown TCP traffic)
Detected TCP or UDP traffic on non-standard ports
Document contains embedded VBA macros
Creates a process in suspended mode (likely to inject code)
Classification
Process Tree |
|---|
|
