Malicious
PDF @0x00000000
MS Office Document
MD5: 11fdd02f407fece395f0fb22fbbe7fdc
Size: 554.5 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
554.5 KB · 554,496 B
First seen
2026-07-13 16:46 · 3 months ago
Last seen
2026-07-13 16:46 · 3 months ago
Last analysis
2026-07-13 16:46 · 3 months ago
Hashes
MD5
11fdd02f407fece395f0fb22fbbe7fdc
Sha1
d71597ed09b11472ed3628a4cba0daf5df7864d8
Sha256
cbcd9d42fda0f69e62c3618fb3043804776b3408708549315b0016a7a96001d5
Sha384
4f19b691249ae25dcfa004e3e2c1f594ab5de0f2495c0b23b25e05a4a3e5706c92a086506ea6139c81d0ad6e22c9ef3c
Sha512
7119a32d1ab2d5427f83c2510e9475f69cc5ac471a2e66f65358dae43150fa00067ffd4db9f9f9d393504bd5a6c211c72078e5d35f234c47e0242c1b3da41ae3
SSDeep
12288:8LkAPXRCY+79QG0Z3S67048ImIZsSgRcEUwqsR0YQqOO:dA/E8f8ImuRE8sTJ
TLSH
7CC4226C32D6DE1EC23B86388F81D0CB540AFC921B49DA2B2B65774E593573D165B08F
3 malicious · 92 files
OFF11fdd02f407fece395f0fb22fbbe7fdcT1221
BINRooT Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD001EAA11
BINOle
BINCompObj
PDFCONTENTS
BINText (Preview)
TXTPage #1
BIN#Stream obj 4 0
BIN#Stream obj 5 0
BINMBD001EAA12
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
BINworksheets
XMLsheet4.xml
XMLsheet2.xml
XMLsheet3.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet7.xml.rels
XMLsheet6.xml.rels
XMLsheet5.xml.rels
XMLsheet4.xml.rels
XMLsheet1.xml
XMLsheet13.xml
XMLsheet11.xml
XMLsheet10.xml
XMLsheet9.xml
XMLsheet7.xml
XMLsheet6.xml
XMLsheet5.xml
XMLsheet14.xml
XMLsheet15.xml
XMLsheet16.xml
BINmedia
EMFimage1.emf
BINembeddings
OFFoleObject1.bin
BINRoot Entry
PDFCONTENTS
BINText (Preview)
TXTPage #1
TXTPage #2
TXTPage #3
TXTPage #4
TXTPage #5
TXTPage #6
TXTPage #7
TXTPage #8
TXTPage #9
TXTPage #10
TXTPage #11
BIN#Stream obj 6 0
BIN#Stream obj 7 0
BIN#Stream obj 12 0
BIN#Stream obj 13 0
BIN#Stream obj 21 0
BIN#Stream obj 24 0
BIN#Stream obj 27 0
BIN#Stream obj 29 0
BIN#Stream obj 28 0
BIN#Stream obj 37 0
BIN#Stream obj 51 0
BIN#Stream obj 65 0
BIN#Stream obj 79 0
BIN#Stream obj 93 0
BIN#Stream obj 107 0
BIN#Stream obj 121 0
BIN#Stream obj 135 0
BIN#Stream obj 150 0
BIN#Stream obj 164 0
TXTStructure
BINdrawings
VMLvmlDrawing1.vml
BIN_rels
XMLvmlDrawing1.vml.rels
XMLsharedStrings.xml
BINtheme
XMLtheme1.xml
XMLstyles.xml
BINprinterSettings
BINprinterSettings4.bin
BINprinterSettings2.bin
BINprinterSettings3.bin
BINprinterSettings1.bin
BINprinterSettings5.bin
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
WMFthumbnail.wmf
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD001EAA13
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 11
STICH kept: 2secondary ignored: 9
bin
5oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>oox:xlsx>oox:rel:ext~T1221
Shape
ole:doc>oox:xlsx>oox:rel:ext
technique3 nodes
Path
ole:doc>oox:xlsx>oox:media>ole:doc
Shape
ole:doc>oox:xlsx>oox:media>ole:doc
4 nodes
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.7 |
| Author | Absa Retail |
| CreationDate | D:20260622120032Z |
| Creator | DocFusion |
| ModifiedDate | D:20260622120032Z |
| Producer | DocFusion |
| /Creator | DocFusion |
| /ModDate | D:20260622120032Z |
| /CreationDate | D:20260622120032Z |
| /Producer | DocFusion |
| /Author | Absa Retail |
| Version | 1.4 |
| CreationDate | D:20260623140016+02'00' |
| Creator | RICOH IM C3010 |
| ModifiedDate | D:20260623140016+02'00' |
| Producer | RICOH IM C3010 |
| /CreationDate | D:20260623140016+02'00' |
| /ModDate | D:20260623140016+02'00' |
| /Creator | RICOH IM C3010 |
| /Producer | RICOH IM C3010 |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 92 files
OFF11fdd02f407fece395f0fb22fbbe7fdcT1221
BINRooT Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD001EAA11
BINMBD001EAA12
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
BINworksheets
BINmedia
BINembeddings
BINdrawings
XMLsharedStrings.xml
BINtheme
XMLstyles.xml
BINprinterSettings
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
BINCompObj
BINMBD001EAA13
BIN_VBA_PROJECT_CUR
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
11fdd02f407fece395f0fb22fbbe7fdc › RooT Entry › MBD001EAA12 › Package › xl › externalLinks › _rels › externalLink1.xml.rels
URI
URI
mailtohuhuhuhuhuhuhu
11fdd02f407fece395f0fb22fbbe7fdc › RooT Entry › MBD001EAA12 › Package › xl › embeddings › oleObject1.bin › Root Entry › CONTENTS
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account