Malicious
2313837f1ac6059e8a0c82f9fd33dbfb
MS Office Document
MD5: 2313837f1ac6059e8a0c82f9fd33dbfb
Size: 7.73 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
This sample is a 7.4 MB MS Office Document classified as malicious by Malva.RE. Static analysis extracted 81 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1059.003, T1202: INDIRECT COMMAND EXECUTION, T1204.002 and T1218: SYSTEM BINARY PROXY EXECUTION. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 7ec8a37604d9119055090f201a07f54619c29ccbdf14f65cf6198e529345ca07
- MD5
- 2313837f1ac6059e8a0c82f9fd33dbfb
- Verdict
- Malicious
- File type
- MS Office Document · 7.4 MB
Cite this report: https://app.malva.re/sha256/7ec8a37604d9119055090f201a07f54619c29ccbdf14f65cf6198e529345ca07
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
7.73 MB · 7,729,152 B
First seen
2026-11-01 01:15 · yesterday
Last seen
2026-11-01 01:15 · yesterday
Last analysis
2026-11-01 01:15 · yesterday
Hashes
MD5
2313837f1ac6059e8a0c82f9fd33dbfb
Sha1
5937146ad4da87d90899da6d8981e9273f994d89
Sha256
7ec8a37604d9119055090f201a07f54619c29ccbdf14f65cf6198e529345ca07
Sha384
b675ab0b744ecca4858ff64786c01789e6d3222fa28eb3bc53ba34e35cd4705c6a153a70d80a47f18ed9527a75790d5c
Sha512
e38c5962456be1dec79be030cd5d2cb59746b15d6857b18c650b3ede2679d02f739bae974c7c4ab986db2f3f0be3ced05e6cac63bceaef92aec6a25b53ecd18c
SSDeep
196608:spiFmy5lfC7B5+T7xEqKPnD0erbk18C1siUjiGbEry/J:spimV7GT7xY7Uhsfbxx
TLSH
DC7633F63C6103D4EC7A377461F68349935BEFB6130762E2136AB26939B111138FB986
4 malicious · 82 files
OFF2313837f1ac6059e8a0c82f9fd33dbfbT1059.003 · T1204.002 · T1202: Indirect Command Execution
BINfil06cc25f409234fbb8062716256afc9bc
BINfil108a557ceb074a76b02c28210345a6ef
BINfil14bbc43c6ea6413ab696eec33646bb6b
BINfil17052c1e14f14d4a83da55f7b38696f4
BINfil1d0db409371b4039abe2d31eea2015db
BINfil2542c901f53b4465a668d632191cba06
BINfil321f6a8e6d1f44a88779081761f91964
BINfil3b315d1d52a74c99ae3e3b263ae883bb
BINfil3cd0429f3c1e4dc8975245ab93381a32
BINfil44414b5a47ee491798f44931897cd726
BINfil4cece0b4ae2949ad88a0fb0287a14d5c
BINfil62e1bf863632449791f79a903d7cdff0
BINfil69ccd261cc824c3982673fbc846cdd72
BINfil6ed270da57c34f0188c9fa75b532e0df
BINfila06e28133831487e88c8f01f32e99599
BINfila5912343d4a04ff8a8000ba748f35ac4
BINfila80725f9d6954edd9a9831d4ce706f48
BINfila9cbaccfdb6e4ca196101d14b2ceab03
BINfilac10da0ae2404b4a934c821411a411f8
BINfilb79497be3d99455ea45cbed71573b9dc
BINfilc34018773fb44b3a85e3f28b6605cc47
BINfilc41c5815da594806b0b1989a2a8cfc77
BINfild2f565e189f94a2a909c228aa4956e1e
BINRoot Entry
BIN䡀䌏䈯
BIN䄦㡥䆾䅤T1059.003 · T1204.002 · T1202: Indirect Command Execution
BINfil06cc25f409234fbb8062716256afc9bc
BINfil108a557ceb074a76b02c28210345a6ef
BINfil14bbc43c6ea6413ab696eec33646bb6b
BINfil17052c1e14f14d4a83da55f7b38696f4
BINfil1d0db409371b4039abe2d31eea2015db
BINfil2542c901f53b4465a668d632191cba06
BINfil321f6a8e6d1f44a88779081761f91964
BINfil3b315d1d52a74c99ae3e3b263ae883bb
BINfil3cd0429f3c1e4dc8975245ab93381a32
BINfil44414b5a47ee491798f44931897cd726
BINfil4cece0b4ae2949ad88a0fb0287a14d5c
BINfil62e1bf863632449791f79a903d7cdff0
EXEfil69ccd261cc824c3982673fbc846cdd72
Structure
P7B[Authenticode]_c4c88034.p7b
BINResources
BINIBC
BINID:0000
BINID:0
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
BIN.Net Resources
BINMSBuild.Strings.resources
BINMSBuild.Strings.shared.resources
BINfil6ed270da57c34f0188c9fa75b532e0df
BINfila06e28133831487e88c8f01f32e99599
BINfila5912343d4a04ff8a8000ba748f35ac4
BINfila80725f9d6954edd9a9831d4ce706f48
BINfila9cbaccfdb6e4ca196101d14b2ceab03
LNKfilac10da0ae2404b4a934c821411a411f8T1059.003 · T1204.002 · T1202: Indirect Command Execution
BIN[Lnk Summary]
BINfilb79497be3d99455ea45cbed71573b9dc
BINfilc34018773fb44b3a85e3f28b6605cc47
BINfild2f565e189f94a2a909c228aa4956e1e
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 5
STICH kept: 1secondary ignored: 4
bin
4Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>bin>lnk~T1059.003~T1202~T1204.002~T1218
Shape
ole:doc>bin>lnk
malicious
3 nodes
LNK: Command Execution
UNKNWOWNmalicious
%ComSphuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential4 malicious · 82 files
OFF2313837f1ac6059e8a0c82f9fd33dbfbT1059.003 · T1204.002 · T1202: Indirect Command Execution
BINfil06cc25f409234fbb8062716256afc9bc
BINfil108a557ceb074a76b02c28210345a6ef
BINfil14bbc43c6ea6413ab696eec33646bb6b
BINfil17052c1e14f14d4a83da55f7b38696f4
BINfil1d0db409371b4039abe2d31eea2015db
BINfil2542c901f53b4465a668d632191cba06
BINfil321f6a8e6d1f44a88779081761f91964
BINfil3b315d1d52a74c99ae3e3b263ae883bb
BINfil3cd0429f3c1e4dc8975245ab93381a32
BINfil44414b5a47ee491798f44931897cd726
BINfil4cece0b4ae2949ad88a0fb0287a14d5c
BINfil62e1bf863632449791f79a903d7cdff0
BINfil69ccd261cc824c3982673fbc846cdd72
BINfil6ed270da57c34f0188c9fa75b532e0df
BINfila06e28133831487e88c8f01f32e99599
BINfila5912343d4a04ff8a8000ba748f35ac4
BINfila80725f9d6954edd9a9831d4ce706f48
BINfila9cbaccfdb6e4ca196101d14b2ceab03
BINfilac10da0ae2404b4a934c821411a411f8
BINfilb79497be3d99455ea45cbed71573b9dc
BINfilc34018773fb44b3a85e3f28b6605cc47
BINfilc41c5815da594806b0b1989a2a8cfc77
BINfild2f565e189f94a2a909c228aa4956e1e
BINRoot Entry
BIN䡀䌏䈯
BIN䄦㡥䆾䅤T1059.003 · T1204.002 · T1202: Indirect Command Execution
BINfil06cc25f409234fbb8062716256afc9bc
BINfil108a557ceb074a76b02c28210345a6ef
BINfil14bbc43c6ea6413ab696eec33646bb6b
BINfil17052c1e14f14d4a83da55f7b38696f4
BINfil1d0db409371b4039abe2d31eea2015db
BINfil2542c901f53b4465a668d632191cba06
BINfil321f6a8e6d1f44a88779081761f91964
BINfil3b315d1d52a74c99ae3e3b263ae883bb
BINfil3cd0429f3c1e4dc8975245ab93381a32
BINfil44414b5a47ee491798f44931897cd726
BINfil4cece0b4ae2949ad88a0fb0287a14d5c
BINfil62e1bf863632449791f79a903d7cdff0
EXEfil69ccd261cc824c3982673fbc846cdd72
BINfil6ed270da57c34f0188c9fa75b532e0df
BINfila06e28133831487e88c8f01f32e99599
BINfila5912343d4a04ff8a8000ba748f35ac4
BINfila80725f9d6954edd9a9831d4ce706f48
BINfila9cbaccfdb6e4ca196101d14b2ceab03
LNKfilac10da0ae2404b4a934c821411a411f8T1059.003 · T1204.002 · T1202: Indirect Command Execution
BIN[Lnk Summary]
BINfilb79497be3d99455ea45cbed71573b9dc
BINfilc34018773fb44b3a85e3f28b6605cc47
BINfild2f565e189f94a2a909c228aa4956e1e
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
%ComSphuhuhuhuhuhuhu
2313837f1ac6059e8a0c82f9fd33dbfb › Root Entry › 䄦㡥䆾䅤 › filac10da0ae2404b4a934c821411a411f8
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account