Malicious MS Office Document analysis – 0309a4cd9f42

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

6 malicious · 103 files

OFF0309a4cd9f42a137bb5ab090178616b5

BINRoot Entry

IMG0x00024A1A.svg

IMG0x000B4345.svg

JScs.js

IMGi128.png

IMGi16.png

IMGi32.png

IMGi48.png

IMGi64.png

ZIPimages.zip

JSONmanifest.json

HTMLpopup.html

JSrunback.js

PS1mse.ps1

PS1[Deobfuscated PS]

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #4 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #5 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #6 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #7 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #8 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #9 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #10 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #11 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #12 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #13 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #14 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #15 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #16 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #17 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #18 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #19 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential