Malicious
0badba5392eb7c974f18b7349559a57a
MS Office Document
MD5: 0badba5392eb7c974f18b7349559a57a
Size: 46.08 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
46.08 KB · 46,080 B
First seen
2026-10-21 10:16 · 4 days ago
Last seen
2026-10-21 10:16 · 4 days ago
Last analysis
2026-10-21 10:16 · 4 days ago
Hashes
MD5
0badba5392eb7c974f18b7349559a57a
Sha1
cf77b282c7b84232817785f336258dfabed94e0f
Sha256
0f28e993fb49f2ec8ba040338c9d68d625935303652ca02b4922927bcace8fee
Sha384
c52e54c29d2da8f55c168e9463cb3025a1985eb9c83445861d9060d01c3fbfa2f2e82f2dec204c02cf50d7ed6633aacc
Sha512
a32b23cb62a41703ba8c12c2b5f5ad969a092613365a3c2de7e0a5ef359dbe99313e03de670097040a040491d153d40e44874477b4ba489472edac6989b97291
SSDeep
768:IM72lXcYM/mgRroNJ9Vn3RrTpCNUXiD0JKScDDwKJeTUrJfvVl9yK0zoNURQ:I51gbroNJ9VBrwNKCRScHvthydom+
TLSH
0C23E1417551CA6BE758FB3A8E9B9BE10720FC54DE0505127BA2335D5EB32893D263CC
15 malicious · 37 files
OFF0badba5392eb7c974f18b7349559a57aT1027 · T1059 · T1105
PS1agentjsT1105 · T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1runcmdT1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
VBSrunvbsT1027 · T1059 · T1059.005
VBSrunvbs.deobfuscated.vbsT1059.005
BINRoot Entry
BIN䡀䌏䈯
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
BIN䄳䏼䄲䞧䄦䠥
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 3
STICH kept: 2secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1059.001~T1105
Shape
ole:doc>scr:ps1
malicious
2 nodes
Path
ole:doc>scr:vbs~T1027~T1059~T1059.005
Shape
ole:doc>scr:vbs
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential15 malicious · 37 files
OFF0badba5392eb7c974f18b7349559a57aT1027 · T1059 · T1105
PS1agentjsT1105 · T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1runcmdT1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
VBSrunvbsT1027 · T1059 · T1059.005
VBSrunvbs.deobfuscated.vbsT1059.005
BINRoot Entry
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
0badba5392eb7c974f18b7349559a57a › runvbs
URL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhu
0badba5392eb7c974f18b7349559a57a › runcmd
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
0badba5392eb7c974f18b7349559a57a › runcmd › [PowerShell Command]
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhu
0badba5392eb7c974f18b7349559a57a › agentjs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account