Malicious MS Word Document analysis – 31b0691f40d5

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

2 malicious · 62 files

DOC31b0691f40d5c1b81e2720bf4cba77e7

XML[Content_Types].xml

BIN_rels

BINword

BIN_rels

XMLdocument.xml.rels

XMLfooter2.xml.rels

OFFsettings.xml.rels

XMLdocument.xml

XMLfootnotes.xml

XMLfooter3.xml

XMLfooter2.xml

XMLheader3.xml

XMLendnotes.xml

BINembeddings

BINmedia

BINtheme

XMLsettings.xml

XMLwebSettings.xml

XMLfontTable.xml

XMLstyles.xml

BINdocProps

Config. Field	Value
Target	https:huhuhuhuhuhuhu
Path	settihuhuhuhuhuhuhu
XPath	/Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML	<Relathuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL #1	https:huhuhuhuhuhuhuhuhuhuhu
URL #2	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
CONTENTS	1.6
CONTENTS	Thomas Schneider
CONTENTS	D:20251013150711+02'00'
CONTENTS	Acrobat PDFMaker 25 für Word
CONTENTS	—
CONTENTS	D:20251013150730+02'00'
CONTENTS	—
CONTENTS	—
CONTENTS	Adobe PDF Library 25.1.20
CONTENTS	Thomas Schneider
CONTENTS	—
CONTENTS	—
CONTENTS	D:20251013150711+02'00'
CONTENTS	Acrobat PDFMaker 25 für Word
CONTENTS	—
CONTENTS	D:20251013150730+02'00'
CONTENTS	Adobe PDF Library 25.1.20
CONTENTS	D:20251013130538
CONTENTS	—
CONTENTS	—

Remote Template - Highly Suspicious URImalicious

https:huhuhuhuhuhuhu

URI URI

https:huhuhuhuhuhuhuhuhuhuhu

URI URI

https:huhuhuhuhuhuhuhuhuhuhu

URI URI

mailtohuhuhuhuhuhuhuhuhuhuhu

URI URI

https:huhuhuhuhuhuhuhuhuhuhu

URI URI

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential