Extracted

Extracted

• • Target

    http://google.com

  Score

  10^/10

  mydoomdefense_evasiondiscoverymacroupxwormxlm

  • Detects MyDoom family

  • MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom

  • Mydoom family

    mydoom

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Suspicious Office macro

    Office document equipped with 4.0 macros.

    macroxlm

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1