Malicious MS Office Document analysis – 0f1f8d21ca19

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

5 malicious · 173 files

OFF0f1f8d21ca192f340b5a0dd6233fc9c7

7Z7z-stream @ 0x00420F92.7z

BINRoot Entry

BIN䡀䌏䈯

BIN䡀㲞䈝䗻

BIN䡀䈖䌧䠤

BIN䡀䌋䄱䜵

BIN䡀䌍䏤䊲

BIN䡀䕎䒵䠵

BIN䌋䄱䜵㷾䚨

BIN䌋䄱䜵㾾䠳

7Z䌧䎶䞁䄦䠥

BIN䡀㬿䏲䐸䖱

BIN䡀㽿䅤䈯䠶

BIN䡀䈏䗤䕸䠨

BIN䡀䈛䌪䗶䜵

BIN䡀䋌䆨㫮䛲

BIN䡀䒌䗱䒵䠯

BIN䡀䓞䕪䇤䠨

BIN䡀䕙䓲䕨䜷

BIN䌋䄱䜵䌾䉱䠲

BIN䡀䆊䌷䑲䈝䗻

BIN䡀䈝䗻䗜䏼䠨

BIN䡀䌍䈵䗦䕲䠼

BIN䡀䒌䓰䑲䑨䠷

BIN䌋䄱䜵䅾䑤䈱䠵

BIN䌋䄱䜵䇾䄬䒯䠪

BIN䌋䄱䜵䗾䅤䄥䎦

PS1䡀㼿䕷䑬㭪䗤䠤

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Base64-Block]

BIN䡀㼿䕷䑬㹪䒲䠯

BIN䡀㿿䏤䇬䗤䒬䠱

BIN䡀䄛䌧㫲䗸䒷䠱

BIN䡀䒌䗱䒵㮯䈹䗱

BIN䡀䕌䄨䈷䒏䇯䕨

BIN䡀䘌䗶䐲䆊䌷䑲

BIN䡀䙎䑨㶷䓤䌳䊱

BIN䌋䄱䜵䆾䐲䏳䗨䠬

BIN䌋䄱䜵䆾䖸䌷䒦䠱

BIN䌋䄱䜵䈾䆻䄯䌰䠦

BIN䌋䄱䜵䌾䖱䌷䒦䠱

BIN䌋䄱䜵䕾䐨䙲䆬䠲

BIN䌋䄱䜵䕾䓨䌤䌵䠦

BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱

BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨

BIN䡀䒌䗱䒵㬯䑲䌧䌷䑲

EXE䌋䄱䜵䄾䆬䖸䄷䗦䇾䏯

BIN䌋䄱䜵䆾䇰䌯䎱䕤䒵䠺

EXE䌋䄱䜵䙾䈬䈺䞵䛨䟨䠁

BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶

BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨

BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦

BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨

BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦

BIN䡀䒋䗲䗶䄵䓳䕨㲞䈜䘴䑨䈦

BINDigitalSignature

EXE䌋䄱䜵㹾䚲䕨䋜䏨㼯䕦䓬㵷䘤䆱䈫䞵䏧䠯

BINSummaryInformation

BINMsiDigitalSignatureEx

EXELDPlayer9_ru_de.poco.shopping_6030_ld.exe

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #4 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #5 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #6 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #7 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #8 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #9 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #10 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #11 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #12 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #13 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #14 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #15 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #16 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #17 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #18 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #19 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #20 URIsuspect

httpshuhuhuhuhuhuhu

URLs in VB Code - #21 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #22 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #23 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #24 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #25 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #26 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #27 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #28 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #29 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #30 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #31 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #32 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #33 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #34 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #35 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #36 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #37 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #38 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #39 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #40 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #41 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #42 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #43 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #44 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #45 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #46 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #47 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #48 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential