Malicious
2805757f5bc272c0ff43a0a03dd8670e
MS Office Document
MD5: 2805757f5bc272c0ff43a0a03dd8670e
Size: 2.27 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 2805757f5bc272c0ff43a0a03dd8670e |
| Sha1 | 7673f2ecf40ce491d8d5b22c1a94e56f87c3ee33 |
| Sha256 | 9508e0869c1eca5ec6969f67320dfa7de12f63b1c73cc20e93fcb7b4c3861812 |
| Sha384 | 516fd2ffb5fe70e0a6d16a664a144e5e7e930e54284c210111b7682fbb9c9f855f8db50b929385bdf53c49b3ea30cf4d |
| Sha512 | 434a2eebc30ed96599f65b115d8994dc173f831f34ba4b573eea955f17d868d7423e45c95cdb7b391f945f27261aea2d0aa34f5ea4171b44df7f0e01963a04e2 |
| SSDeep | 24576:c7Dcs+zkuBYCbM6UEVfofhGVo59FqYGauw4o4Y01qZtLoNmVzd:un8YQuF8VozA3rqZ5oax |
| TLSH | 6EB54C636A50600542B5A8FABEBD5E37795F3409102AD98EFFD31B86E12E6F44C02D1F |
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 2
STICH kept: 1secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:ps1
malicious
2 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
2805757f5bc272c0ff43a0a03dd8670e › Root Entry › 䡀㼿䕷䑬㭪䗤䠤 › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
2805757f5bc272c0ff43a0a03dd8670e › Root Entry › 䡀㼿䕷䑬㭪䗤䠤 › [Deobfuscated PS] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.