Malicious
MS Office Document
MD5: 1e09854c33f885f5f1d42b5e539607c6
Size: 1.14 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
1.14 MB · 1,136,128 B
First seen
2026-07-02 15:02 · 3 months ago
Last seen
2026-07-02 15:02 · 3 months ago
Last analysis
2026-07-03 04:31 · 3 months ago
Hashes
MD5
1e09854c33f885f5f1d42b5e539607c6
Sha1
bfefe0cb64c27189ec8b9e541c7cd35267271b0d
Sha256
1d97f8703f3e94dbb0e8f6a464a3dfbf31d6af073637f4cbd87127daed555391
Sha384
642367e5f3d0364fef7eba36f81361db1c3f8c5e3f8240d6c802e2d31a75bd15f2e8e15e1aab970f530ba32fcb69d0ab
Sha512
06c3812696fd6939894b8aff02a90b7052fc67fcaf5005b005c71816b0e282d5e343aecdba8a03aa6245ee9c6bd0020f7f7d13dd53d287d039348348f4595f01
SSDeep
12288:PAPXRC3A+79QG0WW7zqzjP1wRBME1LrwCJyzcdd1OJRR3c9B2xzfArBP3C+rRIYz:PA/EkAPErjtOJ3jzfyB/zeYiyKr
TLSH
6735124C7599E549C37547B2DFC2C0D2910EBC679E8A811B328E7B5F3F32DA1AA4314A
4 malicious · 85 files
OFF1e09854c33f885f5f1d42b5e539607c6T1221
OFF[Repaired @0x00000E00]
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD0006D1EE
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
BINworksheets
BINmedia
BINembeddings
BINdrawings
XMLsharedStrings.xml
BINtheme
XMLstyles.xml
BINprinterSettings
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
BINCompObj
BINMBD0006D1EF
BINMBD0006D1F0
BIN_VBA_PROJECT_CUR
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| CONTENTS | 1.7 |
| CONTENTS | Absa Retail |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | DocFusion |
| CONTENTS | D:20260622120032Z |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | Absa Retail |
| CONTENTS | 1.7 |
| CONTENTS | D:20250805070422+02'00' |
| CONTENTS | abas Version 2019r4n20p60 |
| CONTENTS | D:20250819130104+08'00' |
| CONTENTS | iText 2.1.7 by 1T3XT |
| CONTENTS | D:20250805070422+02'00' |
| CONTENTS | abas Version 2019r4n20p60 |
| CONTENTS | D:20250819130104+08'00' |
| CONTENTS | iText 2.1.7 by 1T3XT |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential