PDF @0x00000000

MS Office Document

MD5: 1e09854c33f885f5f1d42b5e539607c6

Size: 1.14 MB

application/vnd.ms-office

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

1.14 MB · 1,136,128 B

Hashes

MD5 1e09854c33f885f5f1d42b5e539607c6 Sha1 bfefe0cb64c27189ec8b9e541c7cd35267271b0d Sha256 1d97f8703f3e94dbb0e8f6a464a3dfbf31d6af073637f4cbd87127daed555391 Sha384 642367e5f3d0364fef7eba36f81361db1c3f8c5e3f8240d6c802e2d31a75bd15f2e8e15e1aab970f530ba32fcb69d0ab Sha512 06c3812696fd6939894b8aff02a90b7052fc67fcaf5005b005c71816b0e282d5e343aecdba8a03aa6245ee9c6bd0020f7f7d13dd53d287d039348348f4595f01 SSDeep 12288:PAPXRC3A+79QG0WW7zqzjP1wRBME1LrwCJyzcdd1OJRR3c9B2xzfArBP3C+rRIYz:PA/EkAPErjtOJ3jzfyB/zeYiyKr TLSH 6735124C7599E549C37547B2DFC2C0D2910EBC679E8A811B328E7B5F3F32DA1AA4314A

4 malicious · 85 files

OFF1e09854c33f885f5f1d42b5e539607c6

OFF[Repaired @0x00000E00]

BINRoot Entry

BINCompObj

BINWorkbook

BINSummaryInformation

BINDocumentSummaryInformation

BINMBD0006D1EE

XLSPackage

XML[Content_Types].xml

BIN_rels

XML.rels

BINxl

BIN_rels

XMLworkbook.xml.rels

XMLworkbook.xml

BINworksheets

XMLsheet4.xml

XMLsheet2.xml

XMLsheet3.xml

BIN_rels

XMLsheet1.xml.rels

XMLsheet2.xml.rels

XMLsheet3.xml.rels

XMLsheet7.xml.rels

XMLsheet6.xml.rels

XMLsheet5.xml.rels

XMLsheet4.xml.rels

XMLsheet1.xml

XMLsheet13.xml

XMLsheet12.xml

XMLsheet11.xml

XMLsheet10.xml

XMLsheet9.xml

XMLsheet8.xml

XMLsheet7.xml

XMLsheet6.xml

XMLsheet5.xml

XMLsheet14.xml

XMLsheet15.xml

XMLsheet16.xml

BINmedia

EMFimage1.emf

BINembeddings

OFFoleObject1.bin

BINRoot Entry

PDFCONTENTS

BIN#Stream {UglyToad.PdfPig.Core.XrefLocation}

BINText (Preview)

TXTPage #1

TXTPage #2

TXTPage #3

TXTPage #4

TXTPage #5

TXTPage #6

TXTPage #7

TXTPage #8

TXTPage #9

TXTPage #10

TXTPage #11

TXTStructure

BINdrawings

VMLvmlDrawing1.vml

BIN_rels

XMLvmlDrawing1.vml.rels

XMLsharedStrings.xml

BINtheme

XMLtheme1.xml

XMLstyles.xml

BINprinterSettings

BINprinterSettings4.bin

BINprinterSettings2.bin

BINprinterSettings3.bin

BINprinterSettings1.bin

BINprinterSettings5.bin

BINexternalLinks

XMLexternalLink1.xml

BIN_rels

OFFexternalLink1.xml.rels

BINdocProps

WMFthumbnail.wmf

XMLcore.xml

XMLapp.xml

BINCompObj

BINMBD0006D1EF

BINWorkbook

BINSummaryInformation

BINDocumentSummaryInformation

BINMBD001CD4CA

BINOle

BINCompObj

PDFCONTENTS

BIN#Stream {UglyToad.PdfPig.Core.XrefLocation}

EXIF#Stream {UglyToad.PdfPig.Core.XrefLocation}.exif

IMG#Stream {UglyToad.PdfPig.Core.XrefLocation}-preview.png

BINText (Preview)

TXTPage #1

TXTPage #2

BIN_VBA_PROJECT_CUR

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

BIN_VBA_PROJECT

BINMBD0006D1F0

BINOle

BIN_VBA_PROJECT_CUR

BINPROJECT

BINVBA

BINdir

BIN_VBA_PROJECT

Config. Field	Value
Target	file:/huhuhuhuhuhuhuhuhuhuhu
Path	externhuhuhuhuhuhuhu
XPath	/Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML	<Relathuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
CONTENTS	1.7
CONTENTS	Absa Retail
CONTENTS	D:20260622120032Z
CONTENTS	DocFusion
CONTENTS	D:20260622120032Z
CONTENTS	DocFusion
CONTENTS	DocFusion
CONTENTS	D:20260622120032Z
CONTENTS	D:20260622120032Z
CONTENTS	DocFusion
CONTENTS	Absa Retail
CONTENTS	1.7
CONTENTS	D:20250805070422+02'00'
CONTENTS	abas Version 2019r4n20p60
CONTENTS	D:20250819130104+08'00'
CONTENTS	iText 2.1.7 by 1T3XT
CONTENTS	D:20250805070422+02'00'
CONTENTS	abas Version 2019r4n20p60
CONTENTS	D:20250819130104+08'00'
CONTENTS	iText 2.1.7 by 1T3XT

Remote Template - Highly Suspicious URImalicious

file:/huhuhuhuhuhuhuhuhuhuhu

URI URI

mailtohuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

4 malicious · 85 files

OFF1e09854c33f885f5f1d42b5e539607c6

OFF[Repaired @0x00000E00]

BINRoot Entry

BINCompObj

BINWorkbook

BINSummaryInformation

BINDocumentSummaryInformation

BINMBD0006D1EE

XLSPackage

XML[Content_Types].xml

BIN_rels

BINxl

BIN_rels

XMLworkbook.xml

BINworksheets

BINmedia

BINembeddings

BINdrawings

XMLsharedStrings.xml

BINtheme

XMLstyles.xml

BINprinterSettings

BINexternalLinks

XMLexternalLink1.xml

BIN_rels

OFFexternalLink1.xml.rels

BINdocProps

BINCompObj

BINMBD0006D1EF

BINMBD0006D1F0

BIN_VBA_PROJECT_CUR

Config. Field	Value
Target	file:/huhuhuhuhuhuhuhuhuhuhu
Path	externhuhuhuhuhuhuhu
XPath	/Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML	<Relathuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Remote Template - Highly Suspicious URImalicious

file:/huhuhuhuhuhuhuhuhuhuhu

1e09854c33f885f5f1d42b5e539607c6 › Root Entry › MBD0006D1EE › Package › xl › externalLinks › _rels › externalLink1.xml.rels

URI URI

mailtohuhuhuhuhuhuhu

1e09854c33f885f5f1d42b5e539607c6 › Root Entry › MBD0006D1EE › Package › xl › embeddings › oleObject1.bin › Root Entry › CONTENTS

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential