Malicious
MS Office Document
MD5: 365a40505292342587ae056aa1da95e4
Size: 625.15 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
625.15 KB · 625,152 B
First seen
2026-09-29 07:30 · 26 days ago
Last seen
2026-09-29 07:30 · 26 days ago
Last analysis
2026-09-29 07:30 · 26 days ago
Hashes
MD5
365a40505292342587ae056aa1da95e4
Sha1
9fced13a2fcef919bd27b1254533e919a9b4bdd5
Sha256
b00d2942457169953f1dc009edc00f484f14e83a09c8437cc2166776d23ace3c
Sha384
83881463850f28d191b599dfb1cbd9a4f6842371f394f6e8f0d60dd9fba9d9789c60a0d953c8617fa389a1d9ac95cf36
Sha512
fedef11d66fd0dc7523ede613bff389ae424f485706021c98488b05608dc60ff0a9f82f0d06f875dbe7209aaa8bafa7dacf3789a1bfe9142b24cd686db6aabb0
SSDeep
12288:5w00000000000S02tGboHlf8Pel19ngQ0Az9vert3DM0JspLRUVh9GM4bSiq:5xovgT3ocaR+Te3q
TLSH
D3D4230C36DEDD63E7A75A7697C5919A922AFC8ADE89861F3B00330D2931375906323D
1 malicious · 58 files
OFF365a40505292342587ae056aa1da95e4T1204 · T1221CVE-2017-0199
BINRoot Entry
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
11 / 11
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>img
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>img
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | HttP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.3 |
| Author | dipak |
| CreationDate | D:20260905130956+05'30' |
| Creator | PScript5.dll Version 5.2.2 |
| ModifiedDate | D:20260905130956+05'30' |
| Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| Producer | GPL Ghostscript 9.06 |
| /Producer | GPL Ghostscript 9.06 |
| /CreationDate | D:20260905130956+05'30' |
| /ModDate | D:20260905130956+05'30' |
| /Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| /Creator | PScript5.dll Version 5.2.2 |
| /Author | dipak |
| Version | 1.4 |
| CreationDate | D:20260910044932+00'00' |
| Creator | |
| ModifiedDate | D:20260910044932+00'00' |
| Title | SLES CALIBRATION PRIVATE LIMITED |
| Producer | Skia/PDF m152 |
| /Title | SLES CALIBRATION PRIVATE LIMITED |
| /Creator | |
| /Producer | Skia/PDF m152 |
| /CreationDate | D:20260910044932+00'00' |
| /ModDate | D:20260910044932+00'00' |
| Version | 1.3 |
| Author | dipak |
| CreationDate | D:20260905130956+05'30' |
| Creator | PScript5.dll Version 5.2.2 |
| ModifiedDate | D:20260905130956+05'30' |
| Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| Producer | GPL Ghostscript 9.06 |
| /Producer | GPL Ghostscript 9.06 |
| /CreationDate | D:20260905130956+05'30' |
| /ModDate | D:20260905130956+05'30' |
| /Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| /Creator | PScript5.dll Version 5.2.2 |
| /Author | dipak |