Malicious
MS Word Document
MD5: 1a773e1957d4ed2844041c968154bf7b
Size: 189.29 KB
application/msword
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
189.29 KB · 189,288 B
First seen
2025-08-04 08:45 · one year ago
Last seen
2025-08-04 08:45 · one year ago
Last analysis
2025-08-04 08:46 · one year ago
Hashes
MD5
1a773e1957d4ed2844041c968154bf7b
Sha1
42365b6f91f930f043b120b2a3fbfe2e2f52afbf
Sha256
50dd487e84be733b7f36936f3bfc372a7a405284d17db48e188d91b8a46efe55
Sha384
9a07ac64dcde9dca87116adee86213f94aafefcdea813ea00dbfd704b374b9feb2c38722bbb6caeba4e3cc05d9ef0af2
Sha512
58c1704ee3ba2e36cf6619c0b3e7bbda270717695bc96d4ffc3aceeec22adc5c1b84278ba07c8e13c058daca828312652744ecf5a72d29740510e166408efddb
SSDeep
3072:TD1BQc8EdGdnQDl95StTsUYbeE0ypAB1/JdBD0dm2Y14Zcl0t4YAQVl+loR6FS39:TpgXniSt4UYb66mHdB14Zt4YVzoo
TLSH
39041275643305A4CE23F7B3149F3ECEEA242955E38944A59790B1C89FB343B6A53D23
2 malicious · 32 files
DOC1a773e1957d4ed2844041c968154bf7bT1221
XML[Content_Types].xml
BIN_rels
XML.rels
BINword
BIN_rels
XMLdocument.xml.rels
XMLfooter2.xml.rels
OFFsettings.xml.relsT1221
XMLdocument.xml
XMLfootnotes.xml
XMLfooter3.xml
XMLfooter2.xml
XMLheader3.xml
XMLendnotes.xml
BINembeddings
OFFoleObject1.bin
BINRoot Entry
BINOle
BINCompObj
BINObjInfo
PDFCONTENTS
BINText (Preview)
TXTPage #1
BIN#Stream {21}
BIN#Stream {8}
BIN#Stream {10}
BIN#Stream {17}
BIN#Stream {19}
TXTStructure
BINmedia
EMFimage1.emf
BINtheme
XMLtheme1.xml
XMLsettings.xml
XMLwebSettings.xml
XMLfontTable.xml
XMLstyles.xml
BINdocProps
XMLapp.xml
XMLcore.xml
| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | settihuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| CONTENTS | 1.7 |
| CONTENTS | — |
| CONTENTS | D:20240927035751+07'00' |
| CONTENTS | D:20240927035751+07'00' |
| CONTENTS | Untitled |
| CONTENTS | Microsoft: Print To PDF |
| CONTENTS | — |
| CONTENTS | D:20240927035751+07'00' |
| CONTENTS | D:20240927035751+07'00' |
| CONTENTS | Microsoft: Print To PDF |
| CONTENTS | Untitled |
Remote Template - Highly Suspicious
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential2 malicious · 32 files
DOC1a773e1957d4ed2844041c968154bf7bT1221
XML[Content_Types].xml
BIN_rels
BINword
BIN_rels
XMLdocument.xml.rels
XMLfooter2.xml.rels
OFFsettings.xml.relsT1221
XMLdocument.xml
XMLfootnotes.xml
XMLfooter3.xml
XMLfooter2.xml
XMLheader3.xml
XMLendnotes.xml
BINembeddings
BINmedia
BINtheme
XMLsettings.xml
XMLwebSettings.xml
XMLfontTable.xml
XMLstyles.xml
BINdocProps
| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | settihuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
1a773e1957d4ed2844041c968154bf7b › word › _rels › settings.xml.rels
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account