Malicious
02b32cda6a3c7e45238913945eb3627f
MS Office Document
MD5: 02b32cda6a3c7e45238913945eb3627f
Size: 330.75 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 02b32cda6a3c7e45238913945eb3627f |
| Sha1 | 7192be8a5719ec43653a2d96a6b9b76ee5675e6b |
| Sha256 | 166264152df3b0953897ca9e51add2296e339578c45277e355003b81e08c50a5 |
| Sha384 | 9488dbbff13c409b7e610260ae0f5bef8065b392ea8b3a7007a8e088613d63731bf3e1cb68d6c667c27485c11edbf57c |
| Sha512 | bbabf8507084e6d647d53bf00c0856739d591f05a84343049899a2df8f902d3f2495f195c1f5c7b09fa5fe8e2c72d0c5a1c07a0c10d3024651d01e10de9f9bda |
| SSDeep | 6144:8/u1zta6j5nNO/W4+jHsktx+pOZfqiZGSilZbeBcVdU9eMR3QQ/qC:Rv31NOOtjP1fGbaBQU913zr |
| TLSH | 2C64125933E6C39BE893F979A8D8C0EF4711FC316EA65B0B32C2336E2A756424557306 |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
12 / 12
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf>pdf:stream>bin
malicious
7 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | HTtp:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.4 |
| CreationDate | D:20260910044932+00'00' |
| Creator | |
| ModifiedDate | D:20260910044932+00'00' |
| Title | SLES CALIBRATION PRIVATE LIMITED |
| Producer | Skia/PDF m152 |
| /Title | SLES CALIBRATION PRIVATE LIMITED |
| /Creator | |
| /Producer | Skia/PDF m152 |
| /CreationDate | D:20260910044932+00'00' |
| /ModDate | D:20260910044932+00'00' |
| Version | 1.4 |
| CreationDate | D:20220603065428-04'00' |
| Creator | Apache FOP Version 1.0 |
| Producer | Apache FOP Version 1.0 |
| /Creator | Apache FOP Version 1.0 |
| /Producer | Apache FOP Version 1.0 |
| /CreationDate | D:20220603065428-04'00' |
| Version | 1.4 |
| CreationDate | D:20260910044932+00'00' |
| Creator | |
| ModifiedDate | D:20260910044932+00'00' |
| Title | SLES CALIBRATION PRIVATE LIMITED |
| Producer | Skia/PDF m152 |
| /Title | SLES CALIBRATION PRIVATE LIMITED |
| /Creator | |
| /Producer | Skia/PDF m152 |
| /CreationDate | D:20260910044932+00'00' |
| /ModDate | D:20260910044932+00'00' |
| Version | 1.4 |
| CreationDate | D:20220603065428-04'00' |
| Creator | Apache FOP Version 1.0 |
| Producer | Apache FOP Version 1.0 |
| /Creator | Apache FOP Version 1.0 |
| /Producer | Apache FOP Version 1.0 |
| /CreationDate | D:20220603065428-04'00' |
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | HTtp:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
You must be signed in to view YARA rules.