Malicious
MS Office Document
MD5: 007629a2df91a9dc92ea6d0342ab4c61
Size: 993.28 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
993.28 KB · 993,280 B
First seen
2026-09-29 06:15 · 26 days ago
Last seen
2026-09-29 06:15 · 26 days ago
Last analysis
2026-09-29 06:15 · 26 days ago
Hashes
MD5
007629a2df91a9dc92ea6d0342ab4c61
Sha1
5a626a40a643da566d494f088fd7582f6f5c440d
Sha256
e87d41cf1583e627c40233458912ad8e1092f735fb4c3cc44fa9533a4a037e16
Sha384
37bfc7a11e384518aaeccda21efb1837b2c8b724496a143c32f46425ef881dfb406f5e2d0e5f2253c5ba20da18e82db6
Sha512
4e581fe656f0eb816837d4518f14f9ddfa37535d61f2a1ebf84e6b2d00fb371bbfd08d0a233a8ba5b4d530a22eebf0a420206997c5294ec0d4040b4b3ab1de62
SSDeep
24576:KetXhj0T0kuImjpuK6EAVTWpY6A9oT3V9VGdQwrLihR:HB0AkOuK67CW6BV9Uxri
TLSH
4A252225F549C6B7C0EE58B589879A559077BC46A91DEF0A2384F6FE2F313F16833208
1 malicious · 87 files
OFF007629a2df91a9dc92ea6d0342ab4c61T1204 · T1221CVE-2017-0199
BINRoot Entry
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
11 / 11
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>img
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>img
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | HttP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.3 |
| Author | BASIS |
| CreationDate | D:20260910130015 |
| Creator | Form ZZM_PURCHORD_BR PT |
| Producer | SAP NetWeaver 740 |
| /Author | BASIS |
| /CreationDate | D:20260910130015 |
| /Creator | Form ZZM_PURCHORD_BR PT |
| /Producer | SAP NetWeaver 740 |
| Version | 1.7 |
| Author | Hyme Braga(JCNA) |
| CreationDate | D:20250128101513-03'00' |
| ModifiedDate | D:20250128101513-03'00' |
| Title | Comunicado Pedido de Compras.pdf |
| Producer | Microsoft: Print To PDF |
| /Author | Hyme Braga(JCNA) |
| /CreationDate | D:20250128101513-03'00' |
| /ModDate | D:20250128101513-03'00' |
| /Producer | Microsoft: Print To PDF |
| /Title | Comunicado Pedido de Compras.pdf |