10a9b7e9e4005524475de9e3fef675b2

MS Office Document

MD5: 10a9b7e9e4005524475de9e3fef675b2

Size: 841.73 KB

application/vnd.ms-office

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

841.73 KB · 841,728 B

First seen

2026-10-19 07:45 · 6 days ago

Last seen

2026-10-19 07:45 · 6 days ago

Last analysis

2026-10-19 07:46 · 6 days ago

Hashes

MD5 10a9b7e9e4005524475de9e3fef675b2 Sha1 4d56e5615d4da625e722f321a3d0903ab7dc4cb0 Sha256 8c6f857b33b23709355634bc712b8269c765f59d77e17c20cea652c04edf0cd0 Sha384 dc0cc40be6a70a3019a021059d2cdcee032a9eb4dc4fae20201cf7820fd6288b8e8c7ef4481d5d38e11c2bb226823586 Sha512 3baec79d2348bcfcc930e02534f9cb1966c538bc6c28cfe1bda11a765ca5e7c28a20f8f65b6ecd4b3280b27567d9904d582c153075606f1295ca774416f8d4ee SSDeep 12288:17H/4bH1437MvFbMQ51+OVqISjaWx+Z7W53BhRUfZrGLyKwCngIdVecBACpd:Z0V4xU1n4ISFx+5W5RnULKwCngIdccJ TLSH 3C05231BF5C0DF16C117A23649CDC5AF1098FCA57766B20BBAC1B34E7CB8AF05096299

1 malicious · 63 files

OFF10a9b7e9e4005524475de9e3fef675b2CVE-2017-0199

BINRoot Entry

BINCompObj

BINWorkbook

BINSummaryInformation

BINDocumentSummaryInformation

BINMBD004791A3

XLSPackage

XML[Content_Types].xml

BIN_rels

XML.rels

BINxl

BIN_rels

XMLworkbook.xml.rels

XMLworkbook.xml

BINtheme

XMLtheme1.xml

BINworksheets

XMLsheet2.xml

BIN_rels

XMLsheet1.xml.rels

XMLsheet2.xml.rels

XMLsheet3.xml

XMLsheet1.xml

BINdrawings

BIN_rels

XMLvmlDrawing1.vml.rels

VMLvmlDrawing1.vml

BINmedia

EMFimage1.emf

XMLsharedStrings.xml

BINembeddings

OFFoleObject1.bin

BINRoot Entry

BINOle

BINCompObj

PDFCONTENTS

BINText (Preview)

TXTPage #1

BIN#Stream obj 3 0

BIN#Stream obj 6 0

BIN#Stream obj 11 0

BIN#Stream obj 18 0

BIN#Stream obj 21 0

BIN#Stream obj 29 0

BIN#Stream obj 36 0

BIN#Stream obj 38 0

BIN#Stream obj 44 0

BIN#Stream obj 49 0

BIN#Stream obj 4 0

BIN#Stream obj 5 0

BIN#Stream obj 7 0

BIN#Stream obj 8 0

BIN#Stream obj 19 0

BIN#Stream obj 20 0

BIN#Stream obj 22 0

BIN#Stream obj 23 0

BIN#Stream obj 37 0

BIN#Stream obj 39 0

BIN#Stream obj 13 0

BIN#Stream obj 9 0

BIN#Stream obj 31 0

BIN#Stream obj 27 0

BIN#Stream obj 46 0

BIN#Stream obj 42 0

TXTStructure

XMLstyles.xml

BINprinterSettings

BINprinterSettings2.bin

BINprinterSettings1.bin

BINdocProps

XMLcore.xml

XMLapp.xml

BINCompObj

BINMBD004791A4

BINOle

BIN_VBA_PROJECT_CUR

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

BIN_VBA_PROJECT

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

9 / 9

Path ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin

Shape ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin

malicious 6 nodes

Path ole:doc~T1204~T1221>oox:xlsx>oox:media>bin

Shape ole:doc>oox:xlsx>oox:media>bin

malicious 4 nodes

Config. Field	Value
URL distante (OLE moniker) #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Version	1.7
CreationDate	D:20261007120735
Creator	AutoCAD 2021 - English 2021 (24.0s (LMS Tech))
ModifiedDate	D:20261007120735
Title	COVER
Producer	pdfplot16.hdi 16.00.047.00000
/Creator	AutoCAD 2021 - English 2021 (24.0s (LMS Tech))
/Title	COVER
/Producer	pdfplot16.hdi 16.00.047.00000
/CreationDate	D:20261007120735
/ModDate	D:20261007120735

1 malicious · 63 files

OFF10a9b7e9e4005524475de9e3fef675b2CVE-2017-0199

BINRoot Entry

Config. Field	Value
URL distante (OLE moniker) #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential