Malicious MS Office Document analysis – 16a123f5f1e6

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

10 malicious · 1282 files

OFF16a123f5f1e6627600586bb3d271288a

BINRoot Entry

BIN䡀䌏䈯

BIN䡀䈖䌧䠤

BIN䡀䌋䄱䜵

BIN䡀㬿䏲䐸䖱

BIN䡀㽿䅤䈯䠶

BIN䡀䈏䗤䕸䠨

BIN䡀䕙䓲䕨䜷

BIN䡀䌍䈵䗦䕲䠼

BIN䡀䒌䓰䑲䑨䠷

BIN䡀㼿䕷䑬㭪䗤䠤

BIN䡀㼿䕷䑬㹪䒲䠯

BIN䡀㿿䏤䇬䗤䒬䠱

BIN䡀䖖㯬䏬㱨䖤䠫

BIN䡀䘌䗶䐲䆊䌷䑲

BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨

BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶

BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨

BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦

BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨

BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦

BINSummaryInformation

BIN䂩㼫䔞㹓㻳㳷㴬䃛䅻㬦䚌䚩㯮㼩䕳㺳䑟䇘䖁䄾䇺

BINfYhSUqJPpRtJiKRZxbcCCwfwkFfSprpQVnOe4f

BINfYhSUqJPpRtJiKRZxbcCCwfwkFfSprpQVnOe4faaas

EXErefYhSUqJPpRtJiKRZxbcCCwfwkFfSprpQVnO4f

Structure

BIN[NSIS Installer] @ #00015608

BMPmodern-wizard.bmp

DLLnsDialogs.dll

DLLSystem.dll

BMPmodern-header.bmp

INFOemVista.inf

CATtap0901.cat

EXEtap0901.sys

EXEtapinstall.exe

EXEUpdate.exe

EXELetsPRO.exe

INILetsPRO.ini

DLLCommunityToolkit.Mvvm.dll

DLLDeltaCompressionDotNet.MsDelta.dll

DLLDeltaCompressionDotNet.PatchApi.dll

DLLDeltaCompressionDotNet.dll

DLLFontAwesome.WPF.dll

DLLHardcodet.Wpf.TaskbarNotification.dll

DLLICSharpCode.AvalonEdit.dll

DLLINIFileParser.dll

DLLLetsGoogleAnalytics.dll

EXELetsGoogleAnalytics.exe

BINLetsPRO.exe.config

DLLLetsVPNDomainModel.dll

DLLLetsVPNInfraStructure.dll

DLLMdXaml.dll

DLLMicrosoft.Bcl.AsyncInterfaces.dll

DLLMicrosoft.Expression.Interactions.dll

DLLMicrosoft.Toolkit.Uwp.Notifications.dll

DLLMicrosoft.Web.WebView2.Core.dll

DLLMicrosoft.Web.WebView2.WinForms.dll

DLLMicrosoft.Web.WebView2.Wpf.dll

DLLMicrosoft.Win32.Primitives.dll

DLLMicrosoft.Win32.Registry.AccessControl.dll

DLLMicrosoft.Win32.Registry.dll

DLLMicrosoft.Win32.SystemEvents.dll

DLLMono.Cecil.Mdb.dll

DLLMono.Cecil.Pdb.dll

DLLMono.Cecil.Rocks.dll

DLLMono.Cecil.dll

DLLNewtonsoft.Json.dll

DLLNuGet.Squirrel.dll

DLLPusherClient.dll

DLLSQLite-net.dll

DLLSQLiteNetExtensions.dll

DLLSQLiteNetExtensionsAsync.dll

DLLSQLitePCLRaw.batteries_v2.dll

DLLSQLitePCLRaw.core.dll

DLLSQLitePCLRaw.nativelibrary.dll

DLLSQLitePCLRaw.provider.dynamic_cdecl.dll

DLLSVGImage.dll

DLLSentry.dll

DLLSharpCompress.dll

DLLSquirrel.dll

DLLSuperSocket.ClientEngine.dll

DLLSystem.AppContext.dll

DLLSystem.Buffers.dll

DLLSystem.CodeDom.dll

DLLSystem.Collections.Concurrent.dll

DLLSystem.Collections.Immutable.dll

DLLSystem.Collections.NonGeneric.dll

DLLSystem.Collections.Specialized.dll

DLLSystem.Collections.dll

DLLSystem.ComponentModel.Annotations.dll

DLLSystem.ComponentModel.EventBasedAsync.dll

DLLSystem.ComponentModel.Primitives.dll

DLLSystem.ComponentModel.TypeConverter.dll

DLLSystem.ComponentModel.dll

DLLSystem.Configuration.ConfigurationManager.dll

DLLSystem.Console.dll

DLLSystem.Data.Common.dll

DLLSystem.Data.Odbc.dll

DLLSystem.Data.OleDb.dll

DLLSystem.Data.SqlClient.dll

DLLSystem.Diagnostics.Contracts.dll

DLLSystem.Diagnostics.Debug.dll

DLLSystem.Diagnostics.EventLog.dll

DLLSystem.Diagnostics.FileVersionInfo.dll

DLLSystem.Diagnostics.PerformanceCounter.dll

DLLSystem.Diagnostics.Process.dll

DLLSystem.Diagnostics.StackTrace.dll

DLLSystem.Diagnostics.TextWriterTraceListener.dll

DLLSystem.Diagnostics.Tools.dll

DLLSystem.Diagnostics.TraceSource.dll

DLLSystem.Diagnostics.Tracing.dll

DLLSystem.Drawing.Common.dll

DLLSystem.Drawing.Primitives.dll

DLLSystem.Dynamic.Runtime.dll

DLLSystem.Globalization.Calendars.dll

DLLSystem.Globalization.Extensions.dll

DLLSystem.Globalization.dll

DLLSystem.IO.Compression.ZipFile.dll

DLLSystem.IO.Compression.dll

DLLSystem.IO.FileSystem.AccessControl.dll

DLLSystem.IO.FileSystem.DriveInfo.dll

DLLSystem.IO.FileSystem.Primitives.dll

DLLSystem.IO.FileSystem.Watcher.dll

DLLSystem.IO.FileSystem.dll

DLLSystem.IO.IsolatedStorage.dll

DLLSystem.IO.MemoryMappedFiles.dll

DLLSystem.IO.Packaging.dll

DLLSystem.IO.Pipes.AccessControl.dll

DLLSystem.IO.Pipes.dll

DLLSystem.IO.Ports.dll

DLLSystem.IO.UnmanagedMemoryStream.dll

DLLSystem.IO.dll

DLLSystem.Linq.Expressions.dll

DLLSystem.Linq.Parallel.dll

DLLSystem.Linq.Queryable.dll

DLLSystem.Linq.dll

DLLSystem.Management.Automation.dll

DLLSystem.Memory.dll

DLLSystem.Net.Http.dll

DLLSystem.Net.IPNetwork.dll

DLLSystem.Net.NameResolution.dll

DLLSystem.Net.NetworkInformation.dll

DLLSystem.Net.Ping.dll

DLLSystem.Net.Primitives.dll

DLLSystem.Net.Requests.dll

DLLSystem.Net.Security.dll

DLLSystem.Net.Sockets.dll

DLLSystem.Net.WebHeaderCollection.dll

DLLSystem.Net.WebSockets.Client.dll

DLLSystem.Net.WebSockets.dll

DLLSystem.Numerics.Vectors.dll

DLLSystem.ObjectModel.dll

DLLSystem.Reflection.Extensions.dll

DLLSystem.Reflection.Metadata.dll

DLLSystem.Reflection.Primitives.dll

DLLSystem.Reflection.dll

DLLSystem.Resources.Reader.dll

DLLSystem.Resources.ResourceManager.dll

DLLSystem.Resources.Writer.dll

DLLSystem.Runtime.CompilerServices.Unsafe.dll

DLLSystem.Runtime.CompilerServices.VisualC.dll

DLLSystem.Runtime.Extensions.dll

DLLSystem.Runtime.Handles.dll

DLLSystem.Runtime.InteropServices.RuntimeInformation.dll

DLLSystem.Runtime.InteropServices.dll

DLLSystem.Runtime.Numerics.dll

DLLSystem.Runtime.Serialization.Formatters.dll

DLLSystem.Runtime.Serialization.Json.dll

DLLSystem.Runtime.Serialization.Primitives.dll

DLLSystem.Runtime.Serialization.Xml.dll

DLLSystem.Runtime.dll

DLLSystem.Security.AccessControl.dll

DLLSystem.Security.Claims.dll

DLLSystem.Security.Cryptography.Algorithms.dll

DLLSystem.Security.Cryptography.Cng.dll

DLLSystem.Security.Cryptography.Csp.dll

DLLSystem.Security.Cryptography.Encoding.dll

DLLSystem.Security.Cryptography.Pkcs.dll

DLLSystem.Security.Cryptography.Primitives.dll

DLLSystem.Security.Cryptography.ProtectedData.dll

DLLSystem.Security.Cryptography.X509Certificates.dll

DLLSystem.Security.Cryptography.Xml.dll

DLLSystem.Security.Permissions.dll

DLLSystem.Security.Principal.Windows.dll

DLLSystem.Security.Principal.dll

DLLSystem.Security.SecureString.dll

DLLSystem.ServiceModel.Duplex.dll

DLLSystem.ServiceModel.Http.dll

DLLSystem.ServiceModel.NetTcp.dll

DLLSystem.ServiceModel.Primitives.dll

DLLSystem.ServiceModel.Security.dll

DLLSystem.ServiceModel.Syndication.dll

DLLSystem.ServiceProcess.ServiceController.dll

DLLSystem.Text.Encoding.CodePages.dll

DLLSystem.Text.Encoding.Extensions.dll

DLLSystem.Text.Encoding.dll

DLLSystem.Text.Encodings.Web.dll

DLLSystem.Text.Json.dll

DLLSystem.Text.RegularExpressions.dll

DLLSystem.Threading.AccessControl.dll

DLLSystem.Threading.Overlapped.dll

DLLSystem.Threading.Tasks.Extensions.dll

DLLSystem.Threading.Tasks.Parallel.dll

DLLSystem.Threading.Tasks.dll

DLLSystem.Threading.Thread.dll

DLLSystem.Threading.ThreadPool.dll

DLLSystem.Threading.Timer.dll

DLLSystem.Threading.dll

DLLSystem.ValueTuple.dll

DLLSystem.Web.Services.Description.dll

DLLSystem.Windows.Interactivity.dll

DLLSystem.Xml.ReaderWriter.dll

DLLSystem.Xml.XDocument.dll

DLLSystem.Xml.XPath.XDocument.dll

DLLSystem.Xml.XPath.dll

DLLSystem.Xml.XmlDocument.dll

DLLSystem.Xml.XmlSerializer.dll

DLLToastNotifications.Messages.dll

DLLToastNotifications.dll

DLLUtils.dll

DLLWebSocket4Net.dll

DLLWpfAnimatedGif.dll

DLLlibwin.dll

BINlog4net.config

DLLlog4net.dll

DLLmicrosoft.identitymodel.dll

DLLnetstandard.dll

DLLwintun.dll

IMGnotification_icon.png

DLLWebView2Loader.dll

DLLSystem.Web.Services.Description.resources.dll

DLLLetsPRO.resources.dll

DLLe_sqlite3.dll

EXEndp462-web.exe

DLLnsExec.dll

DLLnsProcess.dll

DLLINetC.dll

PS1[SETUP_DECOMPILED.NSI]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[NSIS Uninstaller] @ #00FBF640

P7B[Authenticode]_3169b97e.p7b

BINResources

EXErfYhSUqJPpRtJiKRZxbcCCwfwkFfSprpQVnO

BINyfYhSUqJPpRtJiKRZxbcCCwfwkFfSprpQVnOf

VBS䌋䄱䜵䑾䋦䉶䋢㾜㳴䓙䗛䌓㻔䛣䆥㬌䉺䎺䉏䓜䓵㿚㸱

BIN䌋䄱䜵䑾䋦䉶䋢㾜㳴䓙䗛䌓㻔䛣䆥㬌䉺䎺䉏䓜䓵㿚㸱.deobfuscated.vbs

SH[Command #0]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BINfYhSUqJPpRtJiKRZxbcCCwfwkFfSprpQVnOe4f

BINfYhSUqJPpRtJiKRZxbcCCwfwkFfSprpQVnOe4faaas

BINrefYhSUqJPpRtJiKRZxbcCCwfwkFfSprpQVnO4f

BINrfYhSUqJPpRtJiKRZxbcCCwfwkFfSprpQVnO

BINyfYhSUqJPpRtJiKRZxbcCCwfwkFfSprpQVnOf

Deobfuscated PowerShell UNKNWOWNmalicious

"&{$b=huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential