Malicious
081c69043496bdf168056b544f1bc9a0
MS Office Document
MD5: 081c69043496bdf168056b544f1bc9a0
Size: 485.89 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 081c69043496bdf168056b544f1bc9a0 |
| Sha1 | 485ddc811d90d6d9415343daff7414180ee6a24c |
| Sha256 | a15c5f00eb3d309cff70e9720fa8ba862ade83fac0688505a0b3893c7c9e699a |
| Sha384 | 6fea969d7cbc2159d8c4fe162856848bf3bbcddc814c684bcb266dab0568f9319ad460261c7c8a86141dd3f263e82e6c |
| Sha512 | b5f4dd22c3bd7605a3c31d5e2a9bb02830e22f7a3dfaf3779d1d40b09a899774b07e73b9218367217e4aaa636e22a7cf2418ea6f13c5d5a2d0ddb493523c0a5b |
| SSDeep | 6144:rqd6oZdRNkaMZm7t86/JaLQKcwOz7HGmldFoVXzFi/7viLJr21U47jgm0cxqSGfq:edfRDEz6/YLQJRzi+oVXhiS26437G9 |
| TLSH | 40A41214B1F59F8AC747BA305CCAC9D91205FDA74F0AC60F3A65B38CE8775CA52A314A |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
9 / 9
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>bin
Shape
ole:doc>oox:xlsx>oox:media>bin
malicious
4 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | httP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.7 |
| Author | Josh McQuinn |
| CreationDate | D:20261009160023-05'00' |
| Creator | Microsoft® Excel® for Microsoft 365 |
| ModifiedDate | D:20261009160023-05'00' |
| Producer | Microsoft® Excel® for Microsoft 365 |
| /Author | Josh McQuinn |
| /CreationDate | D:20261009160023-05'00' |
| /ModDate | D:20261009160023-05'00' |
| /Producer | Microsoft® Excel® for Microsoft 365 |
| /Creator | Microsoft® Excel® for Microsoft 365 |
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | httP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URI
URI
mailtohuhuhuhuhuhuhu
081c69043496bdf168056b544f1bc9a0 › Root Entry › MBD0049B620 › Package › xl › embeddings › oleObject1.bin › Root Entry › CONTENTS
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
081c69043496bdf168056b544f1bc9a0 › Root Entry › MBD0049B620 › Package › xl › embeddings › oleObject1.bin › Root Entry › CONTENTS
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
081c69043496bdf168056b544f1bc9a0 › Root Entry › MBD0049B620 › Package › xl › embeddings › oleObject1.bin › Root Entry › CONTENTS
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.