Malicious
1e7ce442600e367198c44979f20771c1
MS Office Document
MD5: 1e7ce442600e367198c44979f20771c1
Size: 2.27 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 1e7ce442600e367198c44979f20771c1 |
| Sha1 | 2b9ba07e651ed346642b12166167c4ebef2847ae |
| Sha256 | 0bca066c5df38f07b4af969af1041a7f276dfab9e5b07145612f7884bd49be65 |
| Sha384 | d2db3bbb87bd02f1d8310865dbf37d7053c78a2afa2eb2214e32bf2f6a7c112d4741bfbd1a7e29eec5ee1541426f5568 |
| Sha512 | 461e846fb494d4f8a8af3ade36c0d7f495f391da2481e280b2bf18731d4c81f2ffdd33e2a1a28cd6c69df9eb79db09d549e06078092b756b981ecb9f88b2650d |
| SSDeep | 24576:ODcs+zkuBYCbM6UEVfofhGVo59FqYGauw4o4Y01qZtLoNmqaM:On8YQuF8VozA3rqZ5oX5 |
| TLSH | D3B54C636A50600552B5A8FABEBD5E37694F3409102AD98EFFD30B86F52E6F44C02D1F |
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 2
STICH kept: 1secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:ps1
malicious
2 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
1e7ce442600e367198c44979f20771c1 › Root Entry › 䡀㼿䕷䑬㭪䗤䠤 › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
1e7ce442600e367198c44979f20771c1 › Root Entry › 䡀㼿䕷䑬㭪䗤䠤 › [Deobfuscated PS] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.