Malicious
MS Office Document
MD5: 062dd88efc90e49e5b8411a04c3159a7
Size: 386.56 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
386.56 KB · 386,560 B
First seen
2026-07-24 12:16 · 3 months ago
Last seen
2026-07-24 12:16 · 3 months ago
Last analysis
2026-07-26 05:09 · 3 months ago
Hashes
MD5
062dd88efc90e49e5b8411a04c3159a7
Sha1
0e370955fed379ce5bdc2874d172a497d2859de9
Sha256
dd56b35beaf3c0318f4321dadf32f9912ae487ba97f3ed5d3207d6e2aa4c9dd4
Sha384
74f110d4f888f1959b43d82c2a2990f2f5e1578f08c999f64ecd7da5927ebcd795ef0bc29c7b7dbfd270fe68b3f1b5c9
Sha512
1ebef92c49dfe6a4d99f4c22402d4ede5313da5ebd9dc7388fe8325b8ab93ebdf4f23d25ee18c6b17c71be0e13fa8f9a44ece6868efdaac2008524b83830aef8
SSDeep
6144:pIMYZ7b5TE+R+4ThWrZ0Humg7zN48HBYMurGiLomXhp341L3SgM:pIh55TEY3N0WHu7zN4Iur2A4D3M
TLSH
0E84121AF060C32BD693A17444D9D0FE020CFD726F69660FBA81BB4D05395CB9A9D786
3 malicious · 93 files
OFF062dd88efc90e49e5b8411a04c3159a7T1221
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD001DCDCB
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
BINworksheets
BINmedia
BINembeddings
BINdrawings
XMLsharedStrings.xml
BINtheme
XMLstyles.xml
BINprinterSettings
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
BINCompObj
BINMBD001DCDCC
BIN_VBA_PROJECT_CUR
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 11
STICH kept: 2secondary ignored: 9
bin
4img
1oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>oox:xlsx>oox:rel:ext~T1221
Shape
ole:doc>oox:xlsx>oox:rel:ext
technique3 nodes
Path
ole:doc>oox:xlsx>oox:media>ole:doc
Shape
ole:doc>oox:xlsx>oox:media>ole:doc
4 nodes
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.4 |
| Author | City of Johannesburg |
| CreationDate | D:20260622150000+02'00' |
| Subject | Account Number : 556736545 |
| Title | Tax Invoice |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential