Malicious
36da7d26465ae13bb4123fbf7aa28c4e
MS Office Document
MD5: 36da7d26465ae13bb4123fbf7aa28c4e
Size: 10.64 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
10.64 MB · 10,639,360 B
First seen
2026-08-31 16:45 · one month ago
Last seen
2026-08-31 16:45 · one month ago
Last analysis
2026-08-31 16:46 · one month ago
Hashes
MD5
36da7d26465ae13bb4123fbf7aa28c4e
Sha1
daf6a0e5dc6b1c3aa4aef2ed3086d5204d52822a
Sha256
83e297cd50a7076d445707cb91812d432a039a2721aae31088dd3913bcdbd781
Sha384
2826680b338b783004d7fecd254f4e46f600bfc0d0814f43bc44825eb7998cba39e8639dc8db99d833a8bb01b36a7552
Sha512
46cc28a969fba640bc780c81fdfe050341bdd1b5258adcf6f17241215e6ccdf504e628eed2bc092fb81127579c0b91f40e6499f5e790a95fc03f092036a0063b
SSDeep
196608:DJ0J36ikBL3FccXm2Hnzesf/2HB7wM+2EQDdp+yRKEOz:rVljnzesf/Q7wQfJSz
TLSH
55B633EB59E81A3BF2D2743A0CFB491F83503F467047245E8639F9C22AB6E9059F50D9
4 malicious · 718 files
OFF36da7d26465ae13bb4123fbf7aa28c4eT1059.005
BINRoot Entry
BIN䡀䆒䑲
BIN䡀䌏䈯
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
BIN䕳䇲䆸䞷䄦䠥
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䆒䑲㪾䓳䆒䑲䈾䈻
BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINDigitalSignature
BINSummaryInformation
BINMsiDigitalSignatureEx
VBSDecoy0T1059.005
EXE_0023720FD225256D05DB7C15428B3C55
Structure
P7B[Authenticode]_f9bbcd8a.p7b
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN_184DAAB7EC3C4E87A4D096A81483192A
BIN_1BCC6DBC3897A78FF6303717CDAF7B55
BIN_1D121053C0CE46619C570BAEEDE16BB7
EXE_20A3C30A1E973758EAE1993771A634AC
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
EXE_348334CE507BBBB9D58844C3ACC63DEC
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
EXE_3E42B9F343C994C2BEE8CE7BE6DF08A5
Structure
P7B[Authenticode]_86d02839.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN_3EE9D044C075425C81DD7E5BDED97740
BIN_44822355868347C6B0AB7335858B9B1B
EXE_55F1AD7EB0204736732478D61A7C4CE1
Structure
BIN.Net Resources
BINFxResources.System.Diagnostics.DiagnosticSource.SR.resources
XMLILLink.Substitutions.xml
P7B[Authenticode]_91abd80f.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN_5EA130EF618DE5B9F70AD85281B2EDC8
EXE_60F154CAF7FD419E7FAE3BBC7BC3184A
Structure
BIN.Net Resources
BINFxResources.System.Memory.SR.resources
P7B[Authenticode]_8f789375.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
EXE_6553557A78DE05EB466A9426043D4412
Structure
P7B[Authenticode]_507d4455.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINDocumentFormat.OpenXml.Resources.ExceptionMessages.resources
BINDocumentFormat.OpenXml.Validation.ValidationResources.resources
EXE_70B80273ACBA6D368BBA1B71FB96EF64
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
EXE_72C43708391566121453BCD17104A5AB
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
EXE_7BCF858605791495B004DC6D7C332313
Structure
P7B[Authenticode]_68db1969.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINRVTools.AboutBox.resources
ICON$this.Icon
BINRVTools.FMain.resources
BINDatastoreToolStripMenuItem.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINStatusServer.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINStatusUsername.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINStatusVCFullname.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINaboutToolStripMenuItem.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINexitToolStripMenuItem.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINRVTools.FPreferences.resources
BINRVTools.FWait.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINRVTools.Properties.Resources.resources
BINAcrobat
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINAdobePDF
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINHealth_Check
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINHealth_Properties
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINPortgroup
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINPreferences
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINapplication_go
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINarrow_refresh
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINcluster
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINconsole
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINcsv
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdrive
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINdrive_magnify
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINemail
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINerror_icon
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINexcel
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINexclamation_blue
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINexclamation_yellow
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINexport
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINfilter
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINlicense
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINmemory
BINpartition
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpartition1
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINproc
BINresourcePool
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINrvtools_16x16pxpng
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINrvtools_32x32px
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINrvtools_64x64
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINserver_link
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINsnapshot
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINsuccess
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINtwitter
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINvCD
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINvCPU
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINvDatastore
IMG[NBF]root.Data
BINvHost
BINvInfo
BINvMemory
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINvNic
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINvSwitch
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINvTools
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINvUSB1
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINworld_go
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINx-logo-black
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
EXE_A432A4D2E1954EDC4AA7F0515F911879
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
EXE_A7652C65198186B9F3D9AD7410FF6575
Structure
P7B[Authenticode]_5366eba8.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
EXE_AF2F573613A29B08EAF8D1BBE1ACCD53
Structure
P7B[Authenticode]_f330f522.p7b
BINResources
BINIBC
BINID:0000
BINID:0
BINRT_VERSION
BINID:0001
BINID:1033
BIN.Net Resources
BINSystem.Net.Http.SR.resources
EXE_B2F0F5C54896911757331B69D3B38DC4
Structure
P7B[Authenticode]_ae030d4d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Numerics.Vectors.SR.resources
EXE_B5696BAF542730A7EDC83043AE926637
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN_B694B19E91F1480AA61E7D92A0AE2E58
EXE_C4BF29486C0A4A38A6CE1823630231CE
Structure
P7B[Authenticode]_8c38879e.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Buffers.SR.resources
BIN_CDB75EDB4BB27A6C2C8C2775E8B1E763
EXE_CFCE238C48A1ABD5935E75489EB30CB8
Structure
P7B[Authenticode]_6bdae49a.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
RTF_D0CDE47E90F54893845E85E70312E181
EXE_D6EA08ADA651FBA20429CF1AFB281A0D
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
EXE_D71D65078B87897EC309110E3C193843
Structure
P7B[Authenticode]_17262b02.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_DBB36C507EA404A8B6D41FAD5562907B
Structure
P7B[Authenticode]_0a79d4d6.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN_E107A392B92B481CA766BF48D2548406
EXE_E68C0B026C7DADED2E1DA90919C251D1
Structure
PDF_F14A379D2D214949AE2A09418C1C5012
BINText (Preview)
TXTPage #1
TXTPage #2
TXTPage #3
TXTPage #4
TXTPage #5
TXTPage #6
TXTPage #7
TXTPage #8
TXTPage #9
TXTPage #10
TXTPage #11
TXTPage #12
TXTPage #13
TXTPage #14
TXTPage #15
TXTPage #16
TXTPage #17
TXTPage #18
TXTPage #19
TXTPage #20
TXTPage #21
TXTPage #22
TXTPage #23
TXTPage #24
TXTPage #25
TXTPage #26
TXTPage #27
TXTPage #28
TXTPage #29
TXTPage #30
EXE_FC6CF16FA1C6EA883B446EF1D65BDC60
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRoot Entry
BIN䡀䆒䑲
BIN䡀䌏䈯
BIN䡀㲞䈝䗻
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀䌍䏤䊲
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䋜䕲䆷䗸
BIN䡀䒌䗱䒵䠯
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䈝䗻䗜䏼䠨
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䄛䌧㫲䗸䒷䠱
BIN䡀䒌䗱䒵㮯䈹䗱
BIN䡀䕌䄨䈷䒏䇯䕨
BIN䡀䖖㪬䖶䐨䏥䠼
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䙎䑨㶷䓤䌳䊱
BIN䌋䄱䜵㾾㯳䇯㫵䑷
BIN䌋䄱䜵㿾㭜㮗㬝㰏
EXE䌋䄱䜵㶾㿜㭋㬙㭊㵕
Structure
BINResources
BINRT_STRING
BINID:0007
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BIN䌋䄱䜵㷾䚨䏏䕧䗋䠱
BIN䌋䄱䜵䀾䄫䖷䈗㽺䗻
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䒌䗱䒵㬯䑲䌧䌷䑲
BIN䡀䒖䘧䈯䌜䑪䗤䕸䠨
BIN䡀䖖㪬䖶䐨䏥㷼䐤䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䌋䄱䜵㭾䉨䄋䑱䕨䌋䐷䓤
BIN䡀㿿䇶䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
VBS䌋䄱䜵㼾䗨䈗䗻䌍䏤䊲䙾䖥T1059.005
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
VBS䌋䄱䜵㼾䗨䌙㻳䊨䖬䕷㿼䏤䈸䙾䖥T1059.005
BIN䆒䑲䟾㥈㯃㧆㥍㤅㠏㤅㩄㣄㮀㮇䈾䈻
BINDigitalSignature
BIN㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋
EXE_E68C0B026C7DADED2E1DA90919C251D1
Structure
P7B[Authenticode]_ad6dffb6.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
PDF_F14A379D2D214949AE2A09418C1C5012
BINText (Preview)
TXTPage #31
TXTPage #32
TXTPage #33
TXTPage #34
TXTPage #35
TXTPage #36
TXTPage #37
TXTPage #38
TXTPage #39
TXTPage #40
TXTPage #41
TXTPage #42
TXTPage #43
TXTPage #44
TXTPage #45
TXTPage #46
TXTPage #47
TXTPage #48
TXTPage #49
TXTPage #50
TXTPage #51
TXTPage #52
TXTPage #53
TXTPage #54
TXTPage #55
TXTPage #56
TXTPage #57
TXTPage #58
TXTPage #59
TXTPage #60
TXTPage #61
TXTPage #62
TXTPage #63
TXTPage #64
TXTPage #65
TXTPage #66
TXTPage #67
TXTPage #68
TXTPage #69
TXTPage #70
TXTPage #71
TXTPage #72
TXTPage #73
TXTPage #74
TXTPage #75
TXTPage #76
TXTPage #77
TXTPage #78
TXTPage #79
TXTPage #80
TXTPage #81
TXTPage #82
TXTPage #83
TXTPage #84
TXTPage #85
TXTPage #86
TXTPage #87
TXTPage #88
TXTPage #89
TXTPage #90
TXTPage #91
TXTPage #92
TXTPage #93
TXTPage #94
TXTPage #95
TXTPage #96
TXTPage #97
TXTPage #98
TXTPage #99
TXTPage #100
TXTPage #101
TXTPage #102
TXTPage #103
TXTPage #104
TXTPage #105
TXTPage #106
TXTPage #107
TXTPage #108
TXTPage #109
TXTPage #110
TXTPage #111
TXTPage #112
TXTPage #113
TXTPage #114
TXTPage #115
TXTPage #116
TXTPage #117
TXTPage #118
TXTPage #119
TXTPage #120
TXTPage #121
TXTPage #122
TXTPage #123
TXTPage #124
TXTPage #125
TXTPage #126
TXTPage #127
TXTPage #128
TXTPage #129
TXTPage #130
TXTPage #131
TXTPage #132
TXTPage #133
TXTPage #134
TXTPage #135
TXTPage #136
TXTPage #137
TXTPage #138
TXTPage #139
TXTPage #140
TXTPage #141
TXTPage #142
TXTPage #143
TXTPage #144
TXTPage #145
BIN#Stream obj 7882 0
BIN#Stream obj 7886 0
BIN#Stream obj 7890 0
BIN#Stream obj 7892 0
BIN#Stream obj 18 0
BIN#Stream obj 17 0
BIN#Stream obj 5 0
BIN#Stream obj 7894 0
BIN#Stream obj 7896 0
BIN#Stream obj 7881 0
BIN#Stream obj 284 0
BIN#Stream obj 291 0
BIN#Stream obj 290 0
BIN#Stream obj 314 0
BIN#Stream obj 313 0
BIN#Stream obj 319 0
BIN#Stream obj 318 0
BIN#Stream obj 7901 0
BIN#Stream obj 324 0
BIN#Stream obj 323 0
BIN#Stream obj 340 0
BIN#Stream obj 339 0
BIN#Stream obj 344 0
BIN#Stream obj 343 0
BIN#Stream obj 351 0
BIN#Stream obj 350 0
BIN#Stream obj 355 0
BIN#Stream obj 354 0
BIN#Stream obj 359 0
BIN#Stream obj 358 0
BIN#Stream obj 7905 0
BIN#Stream obj 363 0
BIN#Stream obj 362 0
BIN#Stream obj 7898 0
BIN#Stream obj 7897 0
BIN#Stream obj 376 0
BIN#Stream obj 375 0
BIN#Stream obj 379 0
BIN#Stream obj 380 0
BIN#Stream obj 378 0
BIN#Stream obj 388 0
BIN#Stream obj 387 0
BIN#Stream obj 394 0
BIN#Stream obj 393 0
BIN#Stream obj 402 0
BIN#Stream obj 401 0
BIN#Stream obj 405 0
BIN#Stream obj 404 0
BIN#Stream obj 408 0
BIN#Stream obj 407 0
BIN#Stream obj 412 0
BIN#Stream obj 411 0
BIN#Stream obj 416 0
BIN#Stream obj 415 0
BIN#Stream obj 421 0
BIN#Stream obj 420 0
BIN#Stream obj 427 0
BIN#Stream obj 426 0
BIN#Stream obj 430 0
BIN#Stream obj 429 0
BIN#Stream obj 434 0
BIN#Stream obj 433 0
BIN#Stream obj 438 0
BIN#Stream obj 437 0
BIN#Stream obj 440 0
BIN#Stream obj 439 0
BIN#Stream obj 442 0
BIN#Stream obj 441 0
BIN#Stream obj 7904 0
BIN#Stream obj 7916 0
BIN#Stream obj 443 0
IMG#Stream obj 454 0
IMG#Stream obj 454 0-preview.png
BIN#Stream obj 453 0
BIN#Stream obj 456 0
BIN#Stream obj 455 0
BIN#Stream obj 457 0
BIN#Stream obj 20 0
BIN#Stream obj 7918 0
BIN#Stream obj 7917 0
BIN#Stream obj 458 0
BIN#Stream obj 468 0
BIN#Stream obj 466 0
BIN#Stream obj 474 0
BIN#Stream obj 7885 0
BIN#Stream obj 481 0
BIN#Stream obj 475 0
BIN#Stream obj 7912 0
BIN#Stream obj 7911 0
BIN#Stream obj 495 0
BIN#Stream obj 501 0
BIN#Stream obj 503 0
BIN#Stream obj 7921 0
BIN#Stream obj 508 0
BIN#Stream obj 7923 0
BIN#Stream obj 509 0
BIN#Stream obj 512 0
BIN#Stream obj 7925 0
BIN#Stream obj 513 0
BIN#Stream obj 517 0
BIN#Stream obj 518 0
BIN#Stream obj 520 0
BIN#Stream obj 523 0
BIN#Stream obj 524 0
BIN#Stream obj 164 0
BIN#Stream obj 525 0
BIN#Stream obj 526 0
BIN#Stream obj 527 0
BIN#Stream obj 528 0
BIN#Stream obj 529 0
BIN#Stream obj 530 0
BIN#Stream obj 531 0
BIN#Stream obj 532 0
BIN#Stream obj 533 0
BIN#Stream obj 7927 0
BIN#Stream obj 7926 0
BIN#Stream obj 534 0
BIN#Stream obj 222 0
BIN#Stream obj 540 0
IMG#Stream obj 542 0
IMG#Stream obj 542 0-preview.png
BIN#Stream obj 541 0
BIN#Stream obj 544 0
BIN#Stream obj 543 0
BIN#Stream obj 545 0
BIN#Stream obj 267 0
BIN#Stream obj 292 0
BIN#Stream obj 7903 0
BIN#Stream obj 300 0
BIN#Stream obj 303 0
BIN#Stream obj 304 0
BIN#Stream obj 306 0
BIN#Stream obj 305 0
BIN#Stream obj 307 0
BIN#Stream obj 308 0
BIN#Stream obj 310 0
BIN#Stream obj 309 0
BIN#Stream obj 311 0
BIN#Stream obj 312 0
BIN#Stream obj 315 0
BIN#Stream obj 316 0
BIN#Stream obj 317 0
BIN#Stream obj 320 0
BIN#Stream obj 321 0
BIN#Stream obj 322 0
BIN#Stream obj 326 0
BIN#Stream obj 327 0
BIN#Stream obj 325 0
BIN#Stream obj 7909 0
BIN#Stream obj 7908 0
BIN#Stream obj 328 0
BIN#Stream obj 337 0
BIN#Stream obj 338 0
BIN#Stream obj 341 0
BIN#Stream obj 342 0
BIN#Stream obj 345 0
BIN#Stream obj 348 0
BIN#Stream obj 349 0
BIN#Stream obj 352 0
BIN#Stream obj 353 0
BIN#Stream obj 356 0
BIN#Stream obj 357 0
BIN#Stream obj 360 0
BIN#Stream obj 361 0
BIN#Stream obj 364 0
BIN#Stream obj 367 0
BIN#Stream obj 368 0
BIN#Stream obj 369 0
BIN#Stream obj 372 0
BIN#Stream obj 373 0
BIN#Stream obj 371 0
BIN#Stream obj 374 0
BIN#Stream obj 377 0
BIN#Stream obj 381 0
BIN#Stream obj 382 0
BIN#Stream obj 383 0
BIN#Stream obj 384 0
BIN#Stream obj 385 0
BIN#Stream obj 386 0
BIN#Stream obj 389 0
BIN#Stream obj 390 0
BIN#Stream obj 391 0
BIN#Stream obj 392 0
BIN#Stream obj 395 0
BIN#Stream obj 396 0
BIN#Stream obj 397 0
BIN#Stream obj 398 0
BIN#Stream obj 399 0
BIN#Stream obj 400 0
BIN#Stream obj 403 0
BIN#Stream obj 406 0
BIN#Stream obj 409 0
BIN#Stream obj 410 0
BIN#Stream obj 413 0
BIN#Stream obj 414 0
BIN#Stream obj 417 0
BIN#Stream obj 418 0
BIN#Stream obj 419 0
BIN#Stream obj 422 0
BIN#Stream obj 423 0
BIN#Stream obj 424 0
BIN#Stream obj 425 0
BIN#Stream obj 428 0
BIN#Stream obj 431 0
BIN#Stream obj 432 0
BIN#Stream obj 435 0
BIN#Stream obj 436 0
BIN#Stream obj 470 0
BIN#Stream obj 471 0
BIN#Stream obj 472 0
BIN#Stream obj 473 0
BIN#Stream obj 469 0
IMG#Stream obj 485 0
IMG#Stream obj 485 0-preview.png
BIN#Stream obj 487 0
IMG#Stream obj 486 0
EXIF#Stream obj 486 0.exif
IMG#Stream obj 486 0-preview.png
BIN#Stream obj 482 0
BIN#Stream obj 490 0
IMG#Stream obj 489 0
EXIF#Stream obj 489 0.exif
IMG#Stream obj 489 0-preview.png
IMG#Stream obj 491 0
IMG#Stream obj 491 0-preview.png
BIN#Stream obj 488 0
IMG#Stream obj 493 0
IMG#Stream obj 493 0-preview.png
IMG#Stream obj 494 0
EXIF#Stream obj 494 0.exif
IMG#Stream obj 494 0-preview.png
BIN#Stream obj 492 0
BIN#Stream obj 502 0
BIN#Stream obj 504 0
BIN#Stream obj 505 0
BIN#Stream obj 7929 0
BIN#Stream obj 553 0
BIN#Stream obj 1060 0
BIN#Stream obj 1575 0
BIN#Stream obj 2096 0
BIN#Stream obj 2622 0
BIN#Stream obj 3141 0
BIN#Stream obj 3679 0
BIN#Stream obj 4196 0
BIN#Stream obj 4720 0
BIN#Stream obj 5247 0
BIN#Stream obj 5804 0
BIN#Stream obj 6345 0
BIN#Stream obj 6877 0
BIN#Stream obj 7393 0
BIN#Stream obj 7880 0
BIN#Stream obj 7931 0
TXTStructure
BINSummaryInformation
BINMsiDigitalSignatureEx
EXEPayloadFile
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:0000
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 18
STICH kept: 4secondary ignored: 14
bin
10img
4Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
4 / 4
Path
ole:doc>ole:doc>scr:vbs~T1059.005
Shape
ole:doc>ole:doc>scr:vbs
technique3 nodes
Path
ole:doc>ole:doc>pdf
Shape
ole:doc>ole:doc>pdf
3 nodes
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.7 |
| Author | Rob de Veij |
| CreationDate | D:20260702105338+01'00' |
| Creator | Microsoft® Word for Microsoft 365 |
| ModifiedDate | D:20260702105338+01'00' |
| Title | RVTools 4.8.1 July 2, 2026 |
| Producer | Microsoft® Word for Microsoft 365 |
| Version | 1.7 |
| Author | Rob de Veij |
| CreationDate | D:20260702105338+01'00' |
| Creator | Microsoft® Word for Microsoft 365 |
| ModifiedDate | D:20260702105338+01'00' |
| Title | RVTools 4.8.1 July 2, 2026 |
| Producer | Microsoft® Word for Microsoft 365 |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_Enabled | true |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_SetDate | 2023-10-13T16:49:30Z |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_Method | Privileged |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_Name | Public No Visual Label |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_SiteId | 945c199a-83a2-4e80-9f8c-5a91be5752dd |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_ActionId | 99a04929-6196-4e8e-ba9f-4d322af4fd51 |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_ContentBits | 0 |
| /Title | RVTools 4.8.1 July 2, 2026 |
| /Author | Rob de Veij |
| /Creator | Microsoft® Word for Microsoft 365 |
| /CreationDate | D:20260702105338+01'00' |
| /ModDate | D:20260702105338+01'00' |
| /Producer | Microsoft® Word for Microsoft 365 |
URI
URI
http:/huhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential4 malicious · 718 files
OFF36da7d26465ae13bb4123fbf7aa28c4eT1059.005
BINRoot Entry
VBSDecoy0T1059.005
EXE_0023720FD225256D05DB7C15428B3C55
BIN_184DAAB7EC3C4E87A4D096A81483192A
BIN_1BCC6DBC3897A78FF6303717CDAF7B55
BIN_1D121053C0CE46619C570BAEEDE16BB7
EXE_20A3C30A1E973758EAE1993771A634AC
EXE_348334CE507BBBB9D58844C3ACC63DEC
EXE_3E42B9F343C994C2BEE8CE7BE6DF08A5
BIN_3EE9D044C075425C81DD7E5BDED97740
BIN_44822355868347C6B0AB7335858B9B1B
EXE_55F1AD7EB0204736732478D61A7C4CE1
BIN_5EA130EF618DE5B9F70AD85281B2EDC8
EXE_60F154CAF7FD419E7FAE3BBC7BC3184A
EXE_6553557A78DE05EB466A9426043D4412
EXE_70B80273ACBA6D368BBA1B71FB96EF64
EXE_72C43708391566121453BCD17104A5AB
EXE_7BCF858605791495B004DC6D7C332313
EXE_A432A4D2E1954EDC4AA7F0515F911879
EXE_A7652C65198186B9F3D9AD7410FF6575
EXE_AF2F573613A29B08EAF8D1BBE1ACCD53
EXE_B2F0F5C54896911757331B69D3B38DC4
EXE_B5696BAF542730A7EDC83043AE926637
BIN_B694B19E91F1480AA61E7D92A0AE2E58
EXE_C4BF29486C0A4A38A6CE1823630231CE
BIN_CDB75EDB4BB27A6C2C8C2775E8B1E763
EXE_CFCE238C48A1ABD5935E75489EB30CB8
RTF_D0CDE47E90F54893845E85E70312E181
EXE_D6EA08ADA651FBA20429CF1AFB281A0D
EXE_D71D65078B87897EC309110E3C193843
EXE_DBB36C507EA404A8B6D41FAD5562907B
BIN_E107A392B92B481CA766BF48D2548406
EXE_E68C0B026C7DADED2E1DA90919C251D1
PDF_F14A379D2D214949AE2A09418C1C5012
EXE_FC6CF16FA1C6EA883B446EF1D65BDC60
BINRoot Entry
BIN䡀䆒䑲
BIN䡀䌏䈯
BIN䡀㲞䈝䗻
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀䌍䏤䊲
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䋜䕲䆷䗸
BIN䡀䒌䗱䒵䠯
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䈝䗻䗜䏼䠨
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䄛䌧㫲䗸䒷䠱
BIN䡀䒌䗱䒵㮯䈹䗱
BIN䡀䕌䄨䈷䒏䇯䕨
BIN䡀䖖㪬䖶䐨䏥䠼
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䙎䑨㶷䓤䌳䊱
BIN䌋䄱䜵㾾㯳䇯㫵䑷
BIN䌋䄱䜵㿾㭜㮗㬝㰏
EXE䌋䄱䜵㶾㿜㭋㬙㭊㵕
BIN䌋䄱䜵㷾䚨䏏䕧䗋䠱
BIN䌋䄱䜵䀾䄫䖷䈗㽺䗻
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䒌䗱䒵㬯䑲䌧䌷䑲
BIN䡀䒖䘧䈯䌜䑪䗤䕸䠨
BIN䡀䖖㪬䖶䐨䏥㷼䐤䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䌋䄱䜵㭾䉨䄋䑱䕨䌋䐷䓤
BIN䡀㿿䇶䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
VBS䌋䄱䜵㼾䗨䈗䗻䌍䏤䊲䙾䖥T1059.005
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
VBS䌋䄱䜵㼾䗨䌙㻳䊨䖬䕷㿼䏤䈸䙾䖥T1059.005
BIN䆒䑲䟾㥈㯃㧆㥍㤅㠏㤅㩄㣄㮀㮇䈾䈻
BINDigitalSignature
BIN㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋
BINSummaryInformation
BINMsiDigitalSignatureEx
EXEPayloadFile
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURI
URI
http:/huhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
mailtohuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
mailtohuhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
mailtohuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
mailtohuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account