Malicious
Malicious

Share on LinkedIn
Print
MS Excel Document
MD5:
Size: 0 B
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
2 malicious · 18 files
XLS16a1902aaaa03a43aca9ea0a9605e478
XML[Content_Types].xml
BINxl
XMLworkbook.xml
BINworksheets
XMLsheet4.xml
BIN_rels
OFFsheet2.xml.rels
XMLsheet2.xml
XMLsheet3.xml
XMLsheet5.xml
XMLsheet1.xml
XMLsharedStrings.xml
XMLstyles.xml
Config. Field Value
Target https:huhuhuhuhuhuhuhuhuhuhu
Path sheethuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Target https:huhuhuhuhuhuhuhuhuhuhu
Path sheethuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Target https:huhuhuhuhuhuhuhuhuhuhu
Path sheethuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Target https:huhuhuhuhuhuhuhuhuhuhu
Path sheethuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Target https:huhuhuhuhuhuhuhuhuhuhu
Path sheethuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Target https:huhuhuhuhuhuhuhuhuhuhu
Path sheethuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Target https:huhuhuhuhuhuhuhuhuhuhu
Path sheethuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Target https:huhuhuhuhuhuhuhuhuhuhu
Path sheethuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Target https:huhuhuhuhuhuhuhuhuhuhu
Path sheethuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Remote Template - Highly Suspicious Document RelationShip URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙