Suspect
MS Office Document
MD5: 21edc8839da40e71e2003013db5ceef6
Size: 814.08 KB
application/vnd.ms-office
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 21edc8839da40e71e2003013db5ceef6 |
| Sha1 | 4e9e132fe20804d89d300087fa565a7b3302557a |
| Sha256 | e71e1bcc0bd45ce8fa03241971c1847b1b19b223b20b167e11f35df520e1d403 |
| Sha384 | 3561bdd66de0758c3233d894402341133ccc0f801f8756d928e049051a9be5a3a1c855800dc4de541a8a9b83b73ceeb8 |
| Sha512 | 0c2cd3ae5954d85fe192603046aec71e6f77b95aede81243518537c181cb8b719074746c978709007cadfedf29b4b6ead00433842325a519fcc91a1b453cf9e4 |
| SSDeep | 12288:DxgRAPXRC5Ih55TEYU+79QG0tGT3N0WDsE/o4iNJoQ3xurptkvBoVMyqCCt4gKV:1gRA/EyAludP4EgNNJTAp4BoVfX/g |
| TLSH | B0052309F9D5BE57D263A2B09CD5838C5118FC432E0BEA2B6DA1335D543A0BCB6C752B |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 11
STICH kept: 1secondary ignored: 10
bin
4img
2oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>oox:xlsx>oox:media>ole:doc
Shape
ole:doc>oox:xlsx>oox:media>ole:doc
4 nodes
| Name | Value |
|---|---|
| Version | 1.4 |
| Author | City of Johannesburg |
| CreationDate | D:20260622150000+02'00' |
| Subject | Account Number : 556736545 |
| Title | Tax Invoice |
| Version | 1.7 |
| Author | Absa Retail |
| CreationDate | D:20260622120032Z |
| Creator | DocFusion |
| ModifiedDate | D:20260622120032Z |
| Producer | DocFusion |
| /Creator | DocFusion |
| /ModDate | D:20260622120032Z |
| /CreationDate | D:20260622120032Z |
| /Producer | DocFusion |
| /Author | Absa Retail |
URI
URI
mailtohuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential