Malicious
Malicious

Share on LinkedIn
Print
MS Word Document
MD5:
Size: 0 B
application/msword
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
2 malicious · 96 files
DOC00aa2df81e7524b69eab1dbcefbfe22d
XML[Content_Types].xml
BINword
BIN_rels
XMLdocument.xml.rels
XMLfooter2.xml.rels
OFFsettings.xml.rels
XMLdocument.xml
XMLfootnotes.xml
XMLfooter3.xml
XMLfooter2.xml
XMLheader2.xml
XMLendnotes.xml
XMLsettings.xml
XMLwebSettings.xml
XMLfontTable.xml
XMLstyles.xml
Config. Field Value
Target https:huhuhuhuhuhuhu
Path settihuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
CONTENTS
1.5
CONTENTS
emreo
CONTENTS
D:20200930160540+03'00'
CONTENTS
PScript5.dll Version 5.2.2
CONTENTS
D:20200930160540+03'00'
CONTENTS
Alış Sipariş
CONTENTS
Acrobat Distiller 9.0.0 (Windows)
CONTENTS
emreo
CONTENTS
D:20200930160540+03'00'
CONTENTS
PScript5.dll Version 5.2.2
CONTENTS
D:20200930160540+03'00'
CONTENTS
Acrobat Distiller 9.0.0 (Windows)
CONTENTS
Alış Sipariş
CONTENTS
1.5
CONTENTS
user
CONTENTS
D:20250625150723+03'00'
CONTENTS
PScript5.dll Version 5.2.2
CONTENTS
D:20250625150723+03'00'
CONTENTS
Q25060C - MOD.xlsx
CONTENTS
Acrobat Distiller 10.1.16 (Windows)
CONTENTS
user
CONTENTS
D:20250625150723+03'00'
CONTENTS
PScript5.dll Version 5.2.2
CONTENTS
D:20250625150723+03'00'
CONTENTS
Acrobat Distiller 10.1.16 (Windows)
CONTENTS
Q25060C - MOD.xlsx
Remote Template - Highly Suspicious URImalicious
https:huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙