Malicious
37bcd985c5292aa5239333508f042b19
MS Office Document
MD5: 37bcd985c5292aa5239333508f042b19
Size: 843.78 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 37bcd985c5292aa5239333508f042b19 |
| Sha1 | 0e1e9a02181b2a3c04d0fdf4131323a960ec697d |
| Sha256 | 5178ad95671ebee9b732e5a1fe8ed1df4ed243394d20afea9debbf2045882d91 |
| Sha384 | 5cd2ead9161db679bafb0300b853a56a3cd626312a2e35c57d41f2b4cfbef7edab95f446250971aa323ed1e45a1d381a |
| Sha512 | e7bc90ade7e44cf8b3e05a4846302f98a2acd74d713ac5b3dfb85c2bd599e8e2be3edf4cbc9413dd574d9f3393379fdb8b7a12f1dc5467d572e31964eccefa5f |
| SSDeep | 24576:KfDRY4dXCklqlTYLNAQD5i711OSYxUNbX:Keyq5myQD5if5iUd |
| TLSH | FC052329FFE8DB6BF05369746789D1AB2218ECAB5E50C9431394731C88323B1F787949 |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
10 / 10
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>img
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>img
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.7 |
| CreationDate | D:20260812045945-04'00' |
| ModifiedDate | D:20260812045945-04'00' |
| Producer | Artifex Ghostscript 10.01.2 |
| /Producer | Artifex Ghostscript 10.01.2 |
| /CreationDate | D:20260812045945-04'00' |
| /ModDate | D:20260812045945-04'00' |
| Version | 1.7 |
| CreationDate | D:20260813162536+08'00' |
| ModifiedDate | D:20260813162536+08'00' |
| Title | BILL_689049890.xlsx |
| Producer | Microsoft: Print To PDF |
| /CreationDate | D:20260813162536+08'00' |
| /ModDate | D:20260813162536+08'00' |
| /Producer | Microsoft: Print To PDF |
| /Title | BILL_689049890.xlsx |
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
You must be signed in to view YARA rules.