Malicious
MS Office Document
MD5: 0badba5392eb7c974f18b7349559a57a
Size: 46.08 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
46.08 KB · 46,080 B
First seen
2026-10-21 10:16 · 4 days ago
Last seen
2026-10-21 10:16 · 4 days ago
Last analysis
2026-10-21 10:16 · 4 days ago
Hashes
MD5
0badba5392eb7c974f18b7349559a57a
Sha1
cf77b282c7b84232817785f336258dfabed94e0f
Sha256
0f28e993fb49f2ec8ba040338c9d68d625935303652ca02b4922927bcace8fee
Sha384
c52e54c29d2da8f55c168e9463cb3025a1985eb9c83445861d9060d01c3fbfa2f2e82f2dec204c02cf50d7ed6633aacc
Sha512
a32b23cb62a41703ba8c12c2b5f5ad969a092613365a3c2de7e0a5ef359dbe99313e03de670097040a040491d153d40e44874477b4ba489472edac6989b97291
SSDeep
768:IM72lXcYM/mgRroNJ9Vn3RrTpCNUXiD0JKScDDwKJeTUrJfvVl9yK0zoNURQ:I51gbroNJ9VBrwNKCRScHvthydom+
TLSH
0C23E1417551CA6BE758FB3A8E9B9BE10720FC54DE0505127BA2335D5EB32893D263CC
15 malicious · 37 files
OFF0badba5392eb7c974f18b7349559a57aT1027 · T1059 · T1105
PS1agentjsT1105 · T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1runcmdT1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
VBSrunvbsT1027 · T1059 · T1059.005
VBSrunvbs.deobfuscated.vbsT1059.005
BINRoot Entry
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 3
STICH kept: 2secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1059.001~T1105
Shape
ole:doc>scr:ps1
malicious
2 nodes
Path
ole:doc>scr:vbs~T1027~T1059~T1059.005
Shape
ole:doc>scr:vbs
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential