Analyze malicious .doc file
File link: https://app.letsdefend.io/download/downloadfile/factura.zip/
Password: infected
NOTE: Do not open on your local environment. It is malicious file.
Tools used:
- VirusTotal
- AnyRun sandbox
Upload the malware in VirusTotal and examine the report. A through examination can be seen with the detection, details, relations and behaviors tabs. To have a more graphically examination the AnyRun sandbox environment can be a good addition.
Question 1
What type of exploit is running as a result of the relevant file running on the victim machine?
Question 2
What is the relevant Exploit CVE code obtained as a result of the analysis?
Question 3
What is the name of the malicious software downloaded from the internet as a result of the file running?
Question 4
What is the ip address and port information it communicates with?
Question 5
What is the exe name it drops to disk after it runs?
Persecure : my learning archive 