Malicious
Malicious

02b32cda6a3c7e45238913945eb3627f

Share on LinkedIn
Print
MS Office Document
MD5: 02b32cda6a3c7e45238913945eb3627f
Size: 330.75 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 02b32cda6a3c7e45238913945eb3627f
Sha1 7192be8a5719ec43653a2d96a6b9b76ee5675e6b
Sha256 166264152df3b0953897ca9e51add2296e339578c45277e355003b81e08c50a5
Sha384 9488dbbff13c409b7e610260ae0f5bef8065b392ea8b3a7007a8e088613d63731bf3e1cb68d6c667c27485c11edbf57c
Sha512 bbabf8507084e6d647d53bf00c0856739d591f05a84343049899a2df8f902d3f2495f195c1f5c7b09fa5fe8e2c72d0c5a1c07a0c10d3024651d01e10de9f9bda
SSDeep 6144:8/u1zta6j5nNO/W4+jHsktx+pOZfqiZGSilZbeBcVdU9eMR3QQ/qC:Rv31NOOtjP1fGbaBQU913zr
TLSH 2C64125933E6C39BE893F979A8D8C0EF4711FC316EA65B0B32C2336E2A756424557306
Root Entry
CompObj
Workbook
SummaryInformation
DocumentSummaryInformation
MBD003D6100
[Content_Types].xml
_rels
.rels
xl
_rels
workbook.xml.rels
workbook.xml
sharedStrings.xml
styles.xml
theme
theme1.xml
worksheets
_rels
sheet1.xml.rels
sheet1.xml
drawings
_rels
vmlDrawing1.vml.rels
vmlDrawing1.vml
media
image2.emf
image1.emf
embeddings
oleObject2.bin
Root Entry
Ole10Native
Text (Preview)
#Stream obj 6 0
#Stream obj 5 0
#Stream obj 5 0-preview.png
#Stream obj 279 0
#Stream obj 282 0
#Stream obj 283 0
#Stream obj 286 0
#Stream obj 287 0
#Stream obj 290 0
#Stream obj 291 0
#Stream obj 294 0
#Stream obj 10 0
Structure
PDF @0x000000EF
oleObject1.bin
Root Entry
Ole10Native
PDF @0x00000095
#Stream obj 7 0
#Stream obj 28 0
#Stream obj 24 0
#Stream obj 25 0
#Stream obj 34 0
#Stream obj 30 0
#Stream obj 10 0
#Stream obj 5 0
#Stream obj 11 0
#Stream obj 16 0
#Stream obj 18 0
#Stream obj 21 0
#Stream obj 7 0
#Stream obj 31 0
printerSettings
printerSettings1.bin
docProps
thumbnail.wmf
core.xml
app.xml
CompObj
MBD003D6101
Ole
_VBA_PROJECT_CUR
PROJECT
PROJECTwm
VBA
dir
_VBA_PROJECT
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
12 / 12
Path ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf>pdf:stream>bin
Shape ole:doc>oox:xlsx>oox:media>pdf>pdf>pdf:stream>bin
malicious 7 nodes
Path ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious 6 nodes
Config. Field Value
URL distante (OLE moniker) #1 HTtp:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Version
1.4
CreationDate
D:20260910044932+00'00'
Creator
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
ModifiedDate
D:20260910044932+00'00'
Title
SLES CALIBRATION PRIVATE LIMITED
Producer
Skia/PDF m152
/Title
SLES CALIBRATION PRIVATE LIMITED
/Creator
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
/Producer
Skia/PDF m152
/CreationDate
D:20260910044932+00'00'
/ModDate
D:20260910044932+00'00'
Version
1.4
CreationDate
D:20220603065428-04'00'
Creator
Apache FOP Version 1.0
Producer
Apache FOP Version 1.0
/Creator
Apache FOP Version 1.0
/Producer
Apache FOP Version 1.0
/CreationDate
D:20220603065428-04'00'
Version
1.4
CreationDate
D:20260910044932+00'00'
Creator
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
ModifiedDate
D:20260910044932+00'00'
Title
SLES CALIBRATION PRIVATE LIMITED
Producer
Skia/PDF m152
/Title
SLES CALIBRATION PRIVATE LIMITED
/Creator
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
/Producer
Skia/PDF m152
/CreationDate
D:20260910044932+00'00'
/ModDate
D:20260910044932+00'00'
Version
1.4
CreationDate
D:20220603065428-04'00'
Creator
Apache FOP Version 1.0
Producer
Apache FOP Version 1.0
/Creator
Apache FOP Version 1.0
/Producer
Apache FOP Version 1.0
/CreationDate
D:20220603065428-04'00'
An error has occurred. This application may no longer respond until reloaded. Reload 🗙