Malicious
062dd88efc90e49e5b8411a04c3159a7
MS Office Document
MD5: 062dd88efc90e49e5b8411a04c3159a7
Size: 386.56 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
386.56 KB · 386,560 B
First seen
2026-07-24 12:16 · 3 months ago
Last seen
2026-07-24 12:16 · 3 months ago
Last analysis
2026-07-26 05:09 · 3 months ago
Hashes
MD5
062dd88efc90e49e5b8411a04c3159a7
Sha1
0e370955fed379ce5bdc2874d172a497d2859de9
Sha256
dd56b35beaf3c0318f4321dadf32f9912ae487ba97f3ed5d3207d6e2aa4c9dd4
Sha384
74f110d4f888f1959b43d82c2a2990f2f5e1578f08c999f64ecd7da5927ebcd795ef0bc29c7b7dbfd270fe68b3f1b5c9
Sha512
1ebef92c49dfe6a4d99f4c22402d4ede5313da5ebd9dc7388fe8325b8ab93ebdf4f23d25ee18c6b17c71be0e13fa8f9a44ece6868efdaac2008524b83830aef8
SSDeep
6144:pIMYZ7b5TE+R+4ThWrZ0Humg7zN48HBYMurGiLomXhp341L3SgM:pIh55TEY3N0WHu7zN4Iur2A4D3M
TLSH
0E84121AF060C32BD693A17444D9D0FE020CFD726F69660FBA81BB4D05395CB9A9D786
3 malicious · 93 files
OFF062dd88efc90e49e5b8411a04c3159a7T1221
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD001DCDCB
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
BINworksheets
XMLsheet4.xml
XMLsheet2.xml
XMLsheet3.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet7.xml.rels
XMLsheet6.xml.rels
XMLsheet5.xml.rels
XMLsheet4.xml.rels
XMLsheet1.xml
XMLsheet13.xml
XMLsheet12.xml
XMLsheet11.xml
XMLsheet10.xml
XMLsheet9.xml
XMLsheet8.xml
XMLsheet7.xml
XMLsheet6.xml
XMLsheet5.xml
XMLsheet14.xml
XMLsheet15.xml
XMLsheet16.xml
BINmedia
EMFimage1.emf
BINembeddings
OFFoleObject1.bin
BINRoot Entry
BINOle
BINCompObj
PDFCONTENTS
BINText (Preview)
TXTPage #1
TXTPage #2
BIN#Stream obj 6 0
BIN#Stream obj 10 0
BIN#Stream obj 11 0
BIN#Stream obj 12 0
BIN#Stream obj 13 0
BIN#Stream obj 14 0
IMG#Stream obj 26 0
IMG#Stream obj 26 0-preview.png
BIN#Stream obj 40 0
BIN#Stream obj 27 0
BIN#Stream obj 41 0
BIN#Stream obj 28 0
BIN#Stream obj 42 0
BIN#Stream obj 29 0
BIN#Stream obj 44 0
BIN#Stream obj 31 0
BIN#Stream obj 45 0
BIN#Stream obj 32 0
BIN#Stream obj 47 0
BIN#Stream obj 33 0
BIN#Stream obj 34 0
BIN#Stream obj 20 0
BIN#Stream obj 21 0
BIN#Stream obj 22 0
BIN#Stream obj 23 0
BIN#Stream obj 24 0
IMG#Stream obj 36 0
IMG#Stream obj 36 0-preview.png
IMG#Stream obj 37 0
IMG#Stream obj 37 0-preview.png
BIN#Stream obj 38 0
TXTStructure
BINdrawings
VMLvmlDrawing1.vml
BIN_rels
XMLvmlDrawing1.vml.rels
XMLsharedStrings.xml
BINtheme
XMLtheme1.xml
XMLstyles.xml
BINprinterSettings
BINprinterSettings4.bin
BINprinterSettings2.bin
BINprinterSettings3.bin
BINprinterSettings1.bin
BINprinterSettings5.bin
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
WMFthumbnail.wmf
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD001DCDCC
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 11
STICH kept: 2secondary ignored: 9
bin
4img
1oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>oox:xlsx>oox:rel:ext~T1221
Shape
ole:doc>oox:xlsx>oox:rel:ext
technique3 nodes
Path
ole:doc>oox:xlsx>oox:media>ole:doc
Shape
ole:doc>oox:xlsx>oox:media>ole:doc
4 nodes
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.4 |
| Author | City of Johannesburg |
| CreationDate | D:20260622150000+02'00' |
| Subject | Account Number : 556736545 |
| Title | Tax Invoice |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 93 files
OFF062dd88efc90e49e5b8411a04c3159a7T1221
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD001DCDCB
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
BINworksheets
BINmedia
BINembeddings
BINdrawings
XMLsharedStrings.xml
BINtheme
XMLstyles.xml
BINprinterSettings
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
BINCompObj
BINMBD001DCDCC
BIN_VBA_PROJECT_CUR
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
062dd88efc90e49e5b8411a04c3159a7 › Root Entry › MBD001DCDCB › Package › xl › externalLinks › _rels › externalLink1.xml.rels
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account