Malicious
MS Office Document
MD5:
Size: 0 B
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
4 malicious · 107 files
OFF0d30640229f49041e2fac51f6963de6fT1221
OFF[Repaired @0x000A8800]
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD008375F7
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD0018A812
BINMBD0018AB2F
BINMBD0018AD33
XLSPackageT1221
XML[Content_Types].xml
BINxl
BIN_rels
XMLworkbook.xml
BINworksheets
XMLstyles.xml
XMLsharedStrings.xml
BINtheme
BINprinterSettings
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
BINMBD0018B8A2
BINMBD0018BB86
BINMBD00836AA2
BINMBD008375F8
BIN_VBA_PROJECT_CUR
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| CONTENTS | 1.3 |
| CONTENTS | — |
| CONTENTS | D:20240715064615-04'00' |
| CONTENTS | Canon iR3025 |
| CONTENTS | Image |
| CONTENTS | — |
| CONTENTS | Canon iR3025 |
| CONTENTS | Canon iR3025 |
| CONTENTS | D:20240715064615-04'00' |
| CONTENTS | — |
| CONTENTS | Canon iR3025 |
| CONTENTS | — |
| CONTENTS | Image |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential