Suspicious
Suspect

3472bfe286b528c3324a234e101c1ce9

MS Word Document
MD5: 3472bfe286b528c3324a234e101c1ce9
Size: 1.19 MB
application/msword

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 3472bfe286b528c3324a234e101c1ce9
Sha1 cb0fc0410f08b4e1e62e1a2c6350b011bb5cccb5
Sha256 387be3c32b587930c7e5ae3d9c32f1b5e359b2ed3590b40f07ab15cbb3aa7110
Sha384 48703cd233852f8139afb8c6050370a0a57a514adb5d42f6594be82dfaa91f3654d61ec6f96e6d32c94d95f68290d186
Sha512 715ba15be6483731281274b3c9d33db43326c6943ead747fa5f4a9e7d2c5b845d3cd5511dc417147475e58c4a938d7aa4ad910d18ea6665fa08bf8e9ac496cd4
SSDeep 24576:YtaSbSrP2O0/nJaHsiC6bSE+yeeJS7vToOUNTUU2W2w8vG1n3bgoMG3us:EaVyO0/oHm6QyehboO2R2W2w8vG1f5
TLSH DC45231C615B6574DEBA492F0F7E044A98CC93DA057830B891CDB1E6EFA703BC67AD81
3472bfe286b528c3324a234e101c1ce9
[Content_Types].xml
docProps
app.xml
core.xml
word
document.xml
fontTable.xml
ista.rtf
settings.xml
styles.xml
webSettings.xml
theme
theme1.xml
_rels
document.xml.rels
_rels
.rels
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 5 STICH kept: 1secondary ignored: 4
oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path oox:docx>rtf
Shape oox:docx>rtf
2 nodes
3472bfe286b528c3324a234e101c1ce9
[Content_Types].xml
docProps
app.xml
core.xml
word
document.xml
fontTable.xml
ista.rtf
settings.xml
styles.xml
webSettings.xml
theme
theme1.xml
_rels
document.xml.rels
_rels
.rels
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙