b22d7b19...e617

VTI SCORE: 100/100

Dynamic Analysis Report

Classification: -

b22d7b196ca03b43f9b140732a3d317f328e5d5f53379c2520a0f05a17d6e617 (SHA256)

CV gui PVN vv y kien cua UB ve gia han.doc

Word Document

Created at 2019-01-08 12:39:00

Severity	Category	Operation	Classification
5/5	File System	Modifies operating system directory	-
Creates file "C:\Windows\Tasks\Chrome.js" in the OS directory. ... VTI Actions Go to function call
Modifies file "C:\Windows\Tasks\Chrome.js" in the OS directory. ... VTI Actions Go to function call
4/5	Process	Creates process	-
Creates process "cmd /c schtasks /create /sc MINUTE /tn "Chrome" /tr "C:\Windows\Tasks\Chrome.js" /mo 2 /F & schtasks /create /sc MINUTE /tn "Chrome" /tr "C:\Windows\Tasks\Chrome.js" /mo 2 /RU SYSTEM". ... VTI Actions Go to function call
Creates process "C:\Windows\system32\schtasks.exe". ... VTI Actions Go to function call
Creates process "powershell". ... VTI Actions Go to function call
Creates process ""C:\Windows\system32\ipconfig.exe" /all". ... VTI Actions Go to function call
Creates process ""C:\Windows\System32\Wbem\WMIC.exe" csproduct get uuid". ... VTI Actions Go to function call
4/5	Process	Executes encoded PowerShell script	-
Executes encoded PowerShell script to possibly hide malicious payload. ... VTI Actions
3/5	YARA	YARA match	-
Rule "VBA_Create_File" from ruleset "Generic" has matched for "C:\Users\aETAdzjz\Desktop\CV gui PVN vv y kien cua UB ve gia han.doc" ... VTI Actions Go to YARA match
2/5	VBA Macro	Executes macro on specific worksheet event	-
Executes macro automatically on target "document" and event "open". ... VTI Actions Go to macro
1/5	Process	Creates system object	-
Creates mutex with name "Global\.net clr networking". ... VTI Actions Go to function call
1/5	Static	Unparsable sections in file	-
Static analyzer was unable to completely parse the analyzed file: C:\Users\aETAdzjz\Desktop\CV gui PVN vv y kien cua UB ve gia han.doc. ... VTI Actions Go to file details
1/5	Static	Contains embedded files	-
Document contains unknown embedded files. ... VTI Actions Go to file details
1/5	VBA Macro	Contains Office macro	-
Office document contains a VBA macro. ... VTI Actions Go to file details

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Before

After