MS Office Document file analysis – ef3ae6e09448

This sample is a 1 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 80 embedded or derived files and a malware configuration (URLs in PDF). It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: ef3ae6e094487a04fe3a7684c965104b18aacf8ae5c175db4717d8c9f5870e03
MD5: 145a153dfecb1489de83df080f58fb65
Verdict: Inconclusive
File type: MS Office Document · 1 MB

Cite this report: https://app.malva.re/sha256/ef3ae6e094487a04fe3a7684c965104b18aacf8ae5c175db4717d8c9f5870e03

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

1.1 MB · 1,099,264 B

First seen

2026-08-13 04:01 · 2 months ago

Last seen

2026-08-13 04:01 · 2 months ago

Last analysis

2026-08-13 04:02 · 2 months ago

Hashes

MD5 145a153dfecb1489de83df080f58fb65 Sha1 b12cc144c243401a413c37973bde999ad091c0ed Sha256 ef3ae6e094487a04fe3a7684c965104b18aacf8ae5c175db4717d8c9f5870e03 Sha384 da1e295e96ea1461d2101426edf9700295cefe90db600d7e3b86bcb49ac957194c42d6cf317dd2131805867978732807 Sha512 366903867139171b1af89754eb09a4fcf51136301776281e335ae9b0842c3ef5a66cdeebc7dcb8f4ba4baf7e1df133c81a46be4bca972dad8d95cab836d7ff2e SSDeep 24576:gu1UfjvBo5JGyjFVN1wjy9xv8f6Hp7yESWooFoAH:gu1GBccyjFvCjynvr4ESG3 TLSH 6D35236075C6D633CA93DABD0ED38AC5225D6CAAE80ADB16EB89371C303E3F4519714D

81 files

OFF145a153dfecb1489de83df080f58fb65

BINRoot Entry

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 1secondary ignored: 9

bin 4img 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path ole:doc>oox:xlsx>oox:media>ole:doc

Shape ole:doc>oox:xlsx>oox:media>ole:doc

4 nodes

Config. Field	Value
URL #1	https:huhuhuhuhuhuhuhuhuhuhu
URL #2	https:huhuhuhuhuhuhuhuhuhuhu
URL #3	https:huhuhuhuhuhuhuhuhuhuhu
URL #4	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Version	1.7
Author	Labotronics Scientific
CreationDate	D:20260731103220+05'30'
Creator	Labotronics Scientific
Keywords	Quotation \| Labotronics Scientific
ModifiedDate	D:20260731103220+05'30'
Subject	Quotation
Title	LABOT20260731102706
Producer	TCPDF 6.6.5 (http://www.tcpdf.org)
/Title	LABOT20260731102706
/Author	Labotronics Scientific
/Subject	Quotation
/Keywords	Quotation \| Labotronics Scientific
/Creator	Labotronics Scientific
/Producer	TCPDF 6.6.5 (http://www.tcpdf.org)
/CreationDate	D:20260731103220+05'30'
/ModDate	D:20260731103220+05'30'
Version	1.7
CreationDate	D:20260731145050-04'00
Creator	Mozilla Firefox 153.0.1
Producer	cairo 1.18.4 (https://cairographics.org)
/Producer	cairo 1.18.4 (https://cairographics.org)
/Creator	Mozilla Firefox 153.0.1
/CreationDate	D:20260731145050-04'00

URI URI

http:/huhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

145a153dfecb1489de83df080f58fb65

Overview

Summary by MalvaGPT

Characteristics

File Structure

Malware Configuration — URLs in PDF4

Information24

Artefacts1

145a153dfecb1489de83df080f58fb65 (1.1 MB)

File Structure

Malware Configuration — URLs in PDF4

Artefacts1