0946d568385cefcad9fcc458af350f4e

MS Office Document

MD5: 0946d568385cefcad9fcc458af350f4e

Size: 1.06 MB

application/vnd.ms-office

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

MD5	0946d568385cefcad9fcc458af350f4e
Sha1	4b153a15971d9111fde5f5de5eadce65009e5857
Sha256	c1fa1986e9f47abe8c9d2280802409cf4c04d9f482424880c09dcb02472acf9c
Sha384	0367df31c9fefaeb23cce1dbacb7f4c6cd406389a08e62f8867802cf7fce205a694ee69db9210756895b86d7acb876f9
Sha512	a3cc6181f897bf9d3765a7379b96550e8484700d6393e1ed6e51a993f304777863e02cd752a58094531fd96bc063130421fe785c3e6cb12c99824376acb92e5c
SSDeep	24576:Ldj8nnb6YmyH6nIKn213kqg3HGXnZzpQKnhqPbeNwftu:GnnjmOoYTSHGZGKrNwftu
TLSH	DB352374FAD84F2BC591473000C7D2CA516ABF89F26C674336843B89BA799B8B773119

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

9 / 9

Path ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin

Shape ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin

malicious 6 nodes

Path ole:doc~T1204~T1221>oox:xlsx>oox:media>bin

Shape ole:doc>oox:xlsx>oox:media>bin

malicious 4 nodes

Config. Field	Value
URL distante (OLE moniker) #1	htTp:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Version	1.6
Author	marketing
CreationDate	D:20230518161654-05'00'
Creator	PScript5.dll Version 5.2.2
ModifiedDate	D:20230914115104-05'00'
Title	Microsoft Word - Warranty_TWR
Producer	Acrobat Distiller 23.0 (Windows)
Version	1.7
Author	LAB3
CreationDate	D:20260908155520+05'30'
Creator	Microsoft® Word 2016
ModifiedDate	D:20260908155520+05'30'
Producer	Microsoft® Word 2016
/Author	LAB3
/Creator	Microsoft® Word 2016
/CreationDate	D:20260908155520+05'30'
/ModDate	D:20260908155520+05'30'
/Producer	Microsoft® Word 2016
/Author	marketing
/CreationDate	D:20230518161654-05'00'
/Creator	PScript5.dll Version 5.2.2
/ModDate	D:20230914115104-05'00'
/Producer	Acrobat Distiller 23.0 (Windows)
/Title	Microsoft Word - Warranty_TWR

Config. Field	Value
URL distante (OLE moniker) #1	htTp:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

You must be signed in to view YARA rules.