Malicious MS Office Document analysis – 83e297cd50a7

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

10.64 MB · 10,639,360 B

First seen

2026-08-31 16:45 · one month ago

Last seen

2026-08-31 16:45 · one month ago

Last analysis

2026-08-31 16:46 · one month ago

Hashes

MD5 36da7d26465ae13bb4123fbf7aa28c4e Sha1 daf6a0e5dc6b1c3aa4aef2ed3086d5204d52822a Sha256 83e297cd50a7076d445707cb91812d432a039a2721aae31088dd3913bcdbd781 Sha384 2826680b338b783004d7fecd254f4e46f600bfc0d0814f43bc44825eb7998cba39e8639dc8db99d833a8bb01b36a7552 Sha512 46cc28a969fba640bc780c81fdfe050341bdd1b5258adcf6f17241215e6ccdf504e628eed2bc092fb81127579c0b91f40e6499f5e790a95fc03f092036a0063b SSDeep 196608:DJ0J36ikBL3FccXm2Hnzesf/2HB7wM+2EQDdp+yRKEOz:rVljnzesf/Q7wQfJSz TLSH 55B633EB59E81A3BF2D2743A0CFB491F83503F467047245E8639F9C22AB6E9059F50D9

4 malicious · 718 files

OFF36da7d26465ae13bb4123fbf7aa28c4e

BINRoot Entry

VBSDecoy0

EXE_0023720FD225256D05DB7C15428B3C55

BIN_184DAAB7EC3C4E87A4D096A81483192A

BIN_1BCC6DBC3897A78FF6303717CDAF7B55

BIN_1D121053C0CE46619C570BAEEDE16BB7

EXE_20A3C30A1E973758EAE1993771A634AC

EXE_348334CE507BBBB9D58844C3ACC63DEC

EXE_3E42B9F343C994C2BEE8CE7BE6DF08A5

BIN_3EE9D044C075425C81DD7E5BDED97740

BIN_44822355868347C6B0AB7335858B9B1B

EXE_55F1AD7EB0204736732478D61A7C4CE1

BIN_5EA130EF618DE5B9F70AD85281B2EDC8

EXE_60F154CAF7FD419E7FAE3BBC7BC3184A

EXE_6553557A78DE05EB466A9426043D4412

EXE_70B80273ACBA6D368BBA1B71FB96EF64

EXE_72C43708391566121453BCD17104A5AB

EXE_7BCF858605791495B004DC6D7C332313

EXE_A432A4D2E1954EDC4AA7F0515F911879

EXE_A7652C65198186B9F3D9AD7410FF6575

EXE_AF2F573613A29B08EAF8D1BBE1ACCD53

EXE_B2F0F5C54896911757331B69D3B38DC4

EXE_B5696BAF542730A7EDC83043AE926637

BIN_B694B19E91F1480AA61E7D92A0AE2E58

EXE_C4BF29486C0A4A38A6CE1823630231CE

BIN_CDB75EDB4BB27A6C2C8C2775E8B1E763

EXE_CFCE238C48A1ABD5935E75489EB30CB8

RTF_D0CDE47E90F54893845E85E70312E181

EXE_D6EA08ADA651FBA20429CF1AFB281A0D

EXE_D71D65078B87897EC309110E3C193843

EXE_DBB36C507EA404A8B6D41FAD5562907B

BIN_E107A392B92B481CA766BF48D2548406

EXE_E68C0B026C7DADED2E1DA90919C251D1

PDF_F14A379D2D214949AE2A09418C1C5012

EXE_FC6CF16FA1C6EA883B446EF1D65BDC60

BINRoot Entry

BIN䡀䆒䑲

BIN䡀䌏䈯

BIN䡀㲞䈝䗻

BIN䡀䈖䌧䠤

BIN䡀䌋䄱䜵

BIN䡀䌍䏤䊲

BIN䡀㬿䏲䐸䖱

BIN䡀㽿䅤䈯䠶

BIN䡀䈏䗤䕸䠨

BIN䡀䈛䌪䗶䜵

BIN䡀䋜䕲䆷䗸

BIN䡀䒌䗱䒵䠯

BIN䡀䓞䕪䇤䠨

BIN䡀䕙䓲䕨䜷

BIN䡀䈝䗻䗜䏼䠨

BIN䡀䌍䈵䗦䕲䠼

BIN䡀䒌䓰䑲䑨䠷

BIN䡀㼿䕷䑬㭪䗤䠤

BIN䡀㼿䕷䑬㹪䒲䠯

BIN䡀㿿䏤䇬䗤䒬䠱

BIN䡀䄛䌧㫲䗸䒷䠱

BIN䡀䒌䗱䒵㮯䈹䗱

BIN䡀䕌䄨䈷䒏䇯䕨

BIN䡀䖖㪬䖶䐨䏥䠼

BIN䡀䘌䗶䐲䆊䌷䑲

BIN䡀䙎䑨㶷䓤䌳䊱

BIN䌋䄱䜵㾾㯳䇯㫵䑷

BIN䌋䄱䜵㿾㭜㮗㬝㰏

EXE䌋䄱䜵㶾㿜㭋㬙㭊㵕

BIN䌋䄱䜵㷾䚨䏏䕧䗋䠱

BIN䌋䄱䜵䀾䄫䖷䈗㽺䗻

BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨

BIN䡀䒌䗱䒵㬯䑲䌧䌷䑲

BIN䡀䒖䘧䈯䌜䑪䗤䕸䠨

BIN䡀䖖㪬䖶䐨䏥㷼䐤䠨

BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶

BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨

BIN䌋䄱䜵㭾䉨䄋䑱䕨䌋䐷䓤

BIN䡀㿿䇶䄕䑸䋦䒌䇱䗬䒬䠱

BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦

BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨

VBS䌋䄱䜵㼾䗨䈗䗻䌍䏤䊲䙾䖥

BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦

VBS䌋䄱䜵㼾䗨䌙㻳䊨䖬䕷㿼䏤䈸䙾䖥

BIN䆒䑲䟾㥈㯃㧆㥍㤅㠏㤅㩄㣄㮀㮇䈾䈻

BINDigitalSignature

BIN㥿㦀㣀㣉㤏㭅㦈㤎㮋㤃㭂㠇㧆㦏㡌㤅䠋

BINSummaryInformation

BINMsiDigitalSignatureEx

EXEPayloadFile

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 18 STICH kept: 4secondary ignored: 14

bin 10img 4

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path ole:doc>ole:doc>scr:vbs~T1059.005

Shape ole:doc>ole:doc>scr:vbs

technique3 nodes

Path ole:doc>ole:doc>pdf

Shape ole:doc>ole:doc>pdf

3 nodes

Config. Field	Value
URL #1	http:/huhuhuhuhuhuhuhuhuhuhu
URL #2	http:/huhuhuhuhuhuhuhuhuhuhu
URL #3	http:/huhuhuhuhuhuhuhuhuhuhu
URL #4	http:/huhuhuhuhuhuhuhuhuhuhu
URL #5	https:huhuhuhuhuhuhuhuhuhuhu
URL #6	http:/huhuhuhuhuhuhuhuhuhuhu
URL #7	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Version	1.7
Author	Rob de Veij
CreationDate	D:20260702105338+01'00'
Creator	Microsoft® Word for Microsoft 365
ModifiedDate	D:20260702105338+01'00'
Title	RVTools 4.8.1 July 2, 2026
Producer	Microsoft® Word for Microsoft 365
Version	1.7
Author	Rob de Veij
CreationDate	D:20260702105338+01'00'
Creator	Microsoft® Word for Microsoft 365
ModifiedDate	D:20260702105338+01'00'
Title	RVTools 4.8.1 July 2, 2026
Producer	Microsoft® Word for Microsoft 365
/MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_Enabled	true
/MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_SetDate	2023-10-13T16:49:30Z
/MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_Method	Privileged
/MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_Name	Public No Visual Label
/MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_SiteId	945c199a-83a2-4e80-9f8c-5a91be5752dd
/MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_ActionId	99a04929-6196-4e8e-ba9f-4d322af4fd51
/MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_ContentBits	0
/Title	RVTools 4.8.1 July 2, 2026
/Author	Rob de Veij
/Creator	Microsoft® Word for Microsoft 365
/CreationDate	D:20260702105338+01'00'
/ModDate	D:20260702105338+01'00'
/Producer	Microsoft® Word for Microsoft 365

URI URI

http:/huhuhuhuhuhuhu

URI URI

http:/huhuhuhuhuhuhu

URI URI

mailtohuhuhuhuhuhuhu

URI URI

mailtohuhuhuhuhuhuhuhuhuhuhu

URI URI

https:huhuhuhuhuhuhuhuhuhuhu

URI URI

https:huhuhuhuhuhuhuhuhuhuhu

URI URI

http:/huhuhuhuhuhuhuhuhuhuhu

URI URI

https:huhuhuhuhuhuhuhuhuhuhu

URI URI

mailtohuhuhuhuhuhuhu

URI URI

mailtohuhuhuhuhuhuhu

URI URI

http:/huhuhuhuhuhuhuhuhuhuhu

URI URI

http:/huhuhuhuhuhuhuhuhuhuhu

URI URI

http:/huhuhuhuhuhuhuhuhuhuhu

URI URI

http:/huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential