Malicious
Malicious

30e6ca8c4dd2fdd08995b7b35e725bdf

MS Office Document
MD5: 30e6ca8c4dd2fdd08995b7b35e725bdf
Size: 13.33 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

This sample is a 12.7 MB MS Office Document classified as malicious by Malva.RE. Static analysis extracted 61 embedded or derived files. It matches 10 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
fbdcf1c1ef19a5bef2c9ca43b3685aa5dacd78b7b071a90ced67ead83b736fa7
MD5
30e6ca8c4dd2fdd08995b7b35e725bdf
Verdict
Malicious
File type
MS Office Document · 12.7 MB
MITRE ATT&CK
T1027T1059.001

Cite this report: https://app.malva.re/sha256/fbdcf1c1ef19a5bef2c9ca43b3685aa5dacd78b7b071a90ced67ead83b736fa7

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
13.33 MB · 13,328,384 B
First seen
2026-11-04 09:00 · an hour ago
Last seen
2026-11-04 09:00 · an hour ago
Last analysis
2026-11-04 09:00 · an hour ago
Hashes
MD5 30e6ca8c4dd2fdd08995b7b35e725bdf Sha1 d733df31ae3a19d71a167fb2a2e0eb3edce164fb Sha256 fbdcf1c1ef19a5bef2c9ca43b3685aa5dacd78b7b071a90ced67ead83b736fa7 Sha384 7ab578a58c078fa6380fa2b47cf77a0fbe8511d940948c54db05a2e56071ed9d986fa0a0593b9130ed7d31c57e4ab826 Sha512 8648db93661c9962c702c173e979af92c7c45b2eb2a815de77d733c6cde49ee3c6118516677aa87b203b645a817fd53d8b2ebd3ba424693b079b91c1dc73d20c SSDeep 393216:qBr8Q3iwPuUfRpAEPWRU8KjVismtU6B6/+jDONK+6/llQnALTsY6XmgX:CM+nOoU73cEDONd69uny22C TLSH 74D63324E8629737C1BA0D34E6AA8D7DEF387F012762C42E8784F54524B925067F17EE

5 malicious · 62 files
OFF30e6ca8c4dd2fdd08995b7b35e725bdf
BINRoot Entry
BIN䡀䌏䈯
BIN䄦㡥䆾䅤
EXEfilb393f1a6e4a04b70a43d784101385965
Structure
BIN.Net Resources
BINMSBuild.Strings.resources
BINMSBuild.Strings.shared.resources
P7B[Authenticode]_c72d33ec.p7b
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
EXEfilb43aed8d52a64f07950b8db3a1cd349a
Structure
BIN.Net Resources
BINMicrosoft.Data.Edm.resources
BINMicrosoft.Data.Edm.Runtime.vmjavxiq
BINMicrosoft.Data.Edm.Resources.nttuul
BINMicrosoft.Data.Edm.State.rwtbgrto
BINMicrosoft.Data.Edm.Cache.iammwe
BINMicrosoft.Data.Edm.Layout.ipxiprg
BINMicrosoft.Data.Edm.Runtime.jlbrfjbqb
BINMicrosoft.Data.Edm.Layout.tznlgoxge
BINResources
BINRT_VERSION
BINID:0001
BINID:0
PS1filb6500773baae4060b79916790050ca00
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BINfilecfa6a1f527141d2b19b349398e0403e
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
EXE䌋䄱䜵䀾䛬㪌
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINDigitalSignature
BINSummaryInformation
BINfil89f07097e50740ceb385d79f9ccf5f6f
EXEfilb393f1a6e4a04b70a43d784101385965
Structure
P7B[Authenticode]_83d54818.p7b
BINfilb43aed8d52a64f07950b8db3a1cd349a
BINfilb6500773baae4060b79916790050ca00
BINfilecfa6a1f527141d2b19b349398e0403e
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 9 STICH kept: 1secondary ignored: 8
bin 8

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>bin>scr:ps1~T1027~T1059.001
Shape ole:doc>bin>scr:ps1
malicious 3 nodes

Deobfuscated PowerShell UNKNWOWNmalicious
"Starthuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

5 malicious · 62 files
OFF30e6ca8c4dd2fdd08995b7b35e725bdf
BINRoot Entry
BIN䡀䌏䈯
BIN䄦㡥䆾䅤
PS1filb6500773baae4060b79916790050ca00
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BINfilecfa6a1f527141d2b19b349398e0403e
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINDigitalSignature
BINSummaryInformation
BINfil89f07097e50740ceb385d79f9ccf5f6f
BINfilb43aed8d52a64f07950b8db3a1cd349a
BINfilb6500773baae4060b79916790050ca00
BINfilecfa6a1f527141d2b19b349398e0403e
No malware configuration was found at this point.

Deobfuscated PowerShell UNKNWOWNmalicious
"Starthuhuhuhuhuhuhuhuhuhuhu
30e6ca8c4dd2fdd08995b7b35e725bdf › Root Entry › 䄦㡥䆾䅤 › filb6500773baae4060b79916790050ca00 › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙