Malicious
007629a2df91a9dc92ea6d0342ab4c61
MS Office Document
MD5: 007629a2df91a9dc92ea6d0342ab4c61
Size: 993.28 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
993.28 KB · 993,280 B
First seen
2026-09-29 06:15 · 26 days ago
Last seen
2026-09-29 06:15 · 26 days ago
Last analysis
2026-09-29 06:15 · 26 days ago
Hashes
MD5
007629a2df91a9dc92ea6d0342ab4c61
Sha1
5a626a40a643da566d494f088fd7582f6f5c440d
Sha256
e87d41cf1583e627c40233458912ad8e1092f735fb4c3cc44fa9533a4a037e16
Sha384
37bfc7a11e384518aaeccda21efb1837b2c8b724496a143c32f46425ef881dfb406f5e2d0e5f2253c5ba20da18e82db6
Sha512
4e581fe656f0eb816837d4518f14f9ddfa37535d61f2a1ebf84e6b2d00fb371bbfd08d0a233a8ba5b4d530a22eebf0a420206997c5294ec0d4040b4b3ab1de62
SSDeep
24576:KetXhj0T0kuImjpuK6EAVTWpY6A9oT3V9VGdQwrLihR:HB0AkOuK67CW6BV9Uxri
TLSH
4A252225F549C6B7C0EE58B589879A559077BC46A91DEF0A2384F6FE2F313F16833208
1 malicious · 87 files
OFF007629a2df91a9dc92ea6d0342ab4c61T1204 · T1221CVE-2017-0199
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD0126344B
XLSPackage
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
BINworksheets
XMLsheet4.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet4.xml.rels
XMLsheet3.xml.rels
XMLsheet2.xml
XMLsheet3.xml
XMLsheet1.xml
BINdrawings
XMLdrawing4.xml
BIN_rels
XMLdrawing1.xml.rels
XMLvmlDrawing1.vml.rels
XMLdrawing4.xml.rels
XMLdrawing3.xml.rels
XMLdrawing2.xml.rels
XMLdrawing3.xml
VMLvmlDrawing1.vml
XMLdrawing1.xml
XMLdrawing2.xml
BINmedia
IMGimage6.png
IMGimage6.png-preview.png
IMGimage7.png
IMGimage7.png-preview.png
IMGimage5.png
IMGimage5.png-preview.png
IMGimage1.png
IMGimage1.png-preview.png
EMFimage3.emf
EMFimage2.emf
EMFimage4.emf
BINembeddings
OFFoleObject2.bin
BINRoot Entry
BINOle
BINCompObj
PDFCONTENTS
BINText (Preview)
TXTPage #1
TXTPage #2
BIN#Stream obj 7 0
BIN#Stream obj 10 0
BIN#Stream obj 16 0
TXTStructure
OFFoleObject1.bin
BINRoot Entry
PDFCONTENTS
BINText (Preview)
TXTPage #1
BIN#Stream obj 6 0
BIN#Stream obj 7 0
BIN#Stream obj 8 0
BIN#Stream obj 9 0
BIN#Stream obj 10 0
BIN#Stream obj 11 0
BIN#Stream obj 12 0
IMG#Stream obj 4 0
IMG#Stream obj 4 0-preview.png
IMG#Stream obj 5 0
IMG#Stream obj 5 0-preview.png
XMLsharedStrings.xml
XMLstyles.xml
BINtheme
XMLtheme1.xml
BINprinterSettings
BINprinterSettings4.bin
BINprinterSettings2.bin
BINcustomXml
XMLitem3.xml
BIN_rels
XMLitem1.xml.rels
XMLitem2.xml.rels
XMLitem3.xml.rels
XMLitem1.xml
XMLitemProps2.xml
XMLitem2.xml
XMLitemProps1.xml
XMLitemProps3.xml
BINdocProps
WMFthumbnail.wmf
XMLcore.xml
XMLapp.xml
XMLcustom.xml
BINCompObj
BINMBD0126344C
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
11 / 11
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>img
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>img
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | HttP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.3 |
| Author | BASIS |
| CreationDate | D:20260910130015 |
| Creator | Form ZZM_PURCHORD_BR PT |
| Producer | SAP NetWeaver 740 |
| /Author | BASIS |
| /CreationDate | D:20260910130015 |
| /Creator | Form ZZM_PURCHORD_BR PT |
| /Producer | SAP NetWeaver 740 |
| Version | 1.7 |
| Author | Hyme Braga(JCNA) |
| CreationDate | D:20250128101513-03'00' |
| ModifiedDate | D:20250128101513-03'00' |
| Title | Comunicado Pedido de Compras.pdf |
| Producer | Microsoft: Print To PDF |
| /Author | Hyme Braga(JCNA) |
| /CreationDate | D:20250128101513-03'00' |
| /ModDate | D:20250128101513-03'00' |
| /Producer | Microsoft: Print To PDF |
| /Title | Comunicado Pedido de Compras.pdf |
1 malicious · 87 files
OFF007629a2df91a9dc92ea6d0342ab4c61T1204 · T1221CVE-2017-0199
BINRoot Entry
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | HttP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account