Malicious
36da7d26465ae13bb4123fbf7aa28c4e
MS Office Document
MD5: 36da7d26465ae13bb4123fbf7aa28c4e
Size: 10.64 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 36da7d26465ae13bb4123fbf7aa28c4e |
| Sha1 | daf6a0e5dc6b1c3aa4aef2ed3086d5204d52822a |
| Sha256 | 83e297cd50a7076d445707cb91812d432a039a2721aae31088dd3913bcdbd781 |
| Sha384 | 2826680b338b783004d7fecd254f4e46f600bfc0d0814f43bc44825eb7998cba39e8639dc8db99d833a8bb01b36a7552 |
| Sha512 | 46cc28a969fba640bc780c81fdfe050341bdd1b5258adcf6f17241215e6ccdf504e628eed2bc092fb81127579c0b91f40e6499f5e790a95fc03f092036a0063b |
| SSDeep | 196608:DJ0J36ikBL3FccXm2Hnzesf/2HB7wM+2EQDdp+yRKEOz:rVljnzesf/Q7wQfJSz |
| TLSH | 55B633EB59E81A3BF2D2743A0CFB491F83503F467047245E8639F9C22AB6E9059F50D9 |
Malicious
Malicious
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 18
STICH kept: 4secondary ignored: 14
bin
10img
4Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
4 / 4
Path
ole:doc>ole:doc>scr:vbs~T1059.005
Shape
ole:doc>ole:doc>scr:vbs
technique3 nodes
Path
ole:doc>ole:doc>pdf
Shape
ole:doc>ole:doc>pdf
3 nodes
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.7 |
| Author | Rob de Veij |
| CreationDate | D:20260702105338+01'00' |
| Creator | Microsoft® Word for Microsoft 365 |
| ModifiedDate | D:20260702105338+01'00' |
| Title | RVTools 4.8.1 July 2, 2026 |
| Producer | Microsoft® Word for Microsoft 365 |
| Version | 1.7 |
| Author | Rob de Veij |
| CreationDate | D:20260702105338+01'00' |
| Creator | Microsoft® Word for Microsoft 365 |
| ModifiedDate | D:20260702105338+01'00' |
| Title | RVTools 4.8.1 July 2, 2026 |
| Producer | Microsoft® Word for Microsoft 365 |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_Enabled | true |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_SetDate | 2023-10-13T16:49:30Z |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_Method | Privileged |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_Name | Public No Visual Label |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_SiteId | 945c199a-83a2-4e80-9f8c-5a91be5752dd |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_ActionId | 99a04929-6196-4e8e-ba9f-4d322af4fd51 |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_ContentBits | 0 |
| /Title | RVTools 4.8.1 July 2, 2026 |
| /Author | Rob de Veij |
| /Creator | Microsoft® Word for Microsoft 365 |
| /CreationDate | D:20260702105338+01'00' |
| /ModDate | D:20260702105338+01'00' |
| /Producer | Microsoft® Word for Microsoft 365 |
URI
URI
http:/huhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
Malicious
Malicious
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URI
URI
http:/huhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
mailtohuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
mailtohuhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
mailtohuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
mailtohuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
36da7d26465ae13bb4123fbf7aa28c4e › Decoy0 › Root Entry › 㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋 › _F14A379D2D214949AE2A09418C1C5012
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.