Malicious
396f1b3ec53070261ed205db297dfdc8
MS Office Document
MD5: 396f1b3ec53070261ed205db297dfdc8
Size: 8.37 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
This sample is a 8 MB MS Office Document classified as malicious by Malva.RE. Static analysis extracted 77 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1059.003, T1202: INDIRECT COMMAND EXECUTION, T1204.002 and T1218: SYSTEM BINARY PROXY EXECUTION. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- fd133e64799ab52e50eb290d44e446c426a9f91096f8ac7b5293ce81b7bf58e2
- MD5
- 396f1b3ec53070261ed205db297dfdc8
- Verdict
- Malicious
- File type
- MS Office Document · 8 MB
Cite this report: https://app.malva.re/sha256/fd133e64799ab52e50eb290d44e446c426a9f91096f8ac7b5293ce81b7bf58e2
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
8.37 MB · 8,372,224 B
First seen
2026-11-01 01:15 · yesterday
Last seen
2026-11-01 01:15 · yesterday
Last analysis
2026-11-01 01:15 · yesterday
Hashes
MD5
396f1b3ec53070261ed205db297dfdc8
Sha1
b0008ec229ebb9979df117b945d7637f5b92168f
Sha256
fd133e64799ab52e50eb290d44e446c426a9f91096f8ac7b5293ce81b7bf58e2
Sha384
3c468519e5b3b6d918ee48e290449afe08ec13332f4bbd5dd0fffb3253d92d4eae89cf7c779c8e6a051ebafd63473efc
Sha512
2df548f1d9cec8cc17d252841c42c50bae817f0c315363d11fec95ce9b53824edb93e151127219c7a40283aebef6e72b36d8efef95d0759c3cff86653083313d
SSDeep
196608:M/qI+Ljub77sNfxEo33IJtJhsYHHWnBPc27x47:S16jeSEJJhpnWB0e4
TLSH
A68633E37C9AC1EFC58173B2C89B4697C2924E620225F5973953360DAAF7E01A5F630D
3 malicious · 78 files
OFF396f1b3ec53070261ed205db297dfdc8T1059.003 · T1204.002 · T1202: Indirect Command Execution
BINRoot Entry
BIN䡀䌏䈯
BIN䄦㡥䆾䅤
BINfil3f6058f135ed4a97abc26dc9a4434c34
BINfil45e37540e6eb4349b021426c417d226b
BINfil59d0ab37ab314a5dafa248ba44132816
BINfil5dc30144156b48b0a76dbf96e13ec9d5
BINfil68a63a0d4a7547ae9d19c211489ea675
BINfil6f8adc2d002545708ad7859e2ecd27c4
BINfil7bab0d2fc53947efb1ba9d5877bc9bf6
BINfil7d51a848705a4325b0f576875174f86a
BINfil7f2e2ee7443a4c44a0703869c426122b
BINfila538ada59a6046ce89da48eca22f940e
BINfilafc09186440a44c1bb53df1b9e43b2f1
BINfild8626acac2414392be1dba8b612de75d
BINfilda0a221919744fa384b1a37f8e52db0c
BINfilec4836e8b0c342708506fc642b0e7d7d
EXEfilf207ee258fa846b8acecd5ed9221c063
Structure
P7B[Authenticode]_c72d33ec.p7b
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
BIN.Net Resources
BINMSBuild.Strings.resources
BINMSBuild.Strings.shared.resources
BINfilfb45c559c3e04f6a85b102aefead33f3
BINfilfcdf251a0d6f448494912362e80f2616
BINfilfd9ffac801b643d99d11f6b4f15263b4
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
BINfil0054fd455f164028a8b4224bf34912d9
LNKfil02e42b6aecd74e19b215988aa23929cfT1059.003 · T1204.002 · T1202: Indirect Command Execution
BIN[Lnk Summary]
BINfil09dac06adfc0469e8c56f9d2d77aa345
BINfil346c23b43b37408d9827b4d76e8aaba1
BINfil37a5c9060cb142eba82fd00c2b2782fd
BINfil3f6058f135ed4a97abc26dc9a4434c34
BINfil45e37540e6eb4349b021426c417d226b
BINfil59d0ab37ab314a5dafa248ba44132816
BINfil5dc30144156b48b0a76dbf96e13ec9d5
BINfil68a63a0d4a7547ae9d19c211489ea675
BINfil6f8adc2d002545708ad7859e2ecd27c4
BINfil7bab0d2fc53947efb1ba9d5877bc9bf6
BINfil7d51a848705a4325b0f576875174f86a
BINfil7f2e2ee7443a4c44a0703869c426122b
BINfila538ada59a6046ce89da48eca22f940e
BINfilafc09186440a44c1bb53df1b9e43b2f1
BINfild8626acac2414392be1dba8b612de75d
BINfilda0a221919744fa384b1a37f8e52db0c
BINfilec4836e8b0c342708506fc642b0e7d7d
BINfilf207ee258fa846b8acecd5ed9221c063
BINfilf31b33d501904bfcbe61a0bd8b88f41d
BINfilfb45c559c3e04f6a85b102aefead33f3
BINfilfcdf251a0d6f448494912362e80f2616
BINfilfd9ffac801b643d99d11f6b4f15263b4
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 5
STICH kept: 1secondary ignored: 4
bin
4Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>lnk~T1059.003~T1202~T1204.002~T1218
Shape
ole:doc>lnk
malicious
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
%ComSphuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 78 files
OFF396f1b3ec53070261ed205db297dfdc8T1059.003 · T1204.002 · T1202: Indirect Command Execution
BINRoot Entry
BINfil0054fd455f164028a8b4224bf34912d9
LNKfil02e42b6aecd74e19b215988aa23929cfT1059.003 · T1204.002 · T1202: Indirect Command Execution
BIN[Lnk Summary]
BINfil09dac06adfc0469e8c56f9d2d77aa345
BINfil346c23b43b37408d9827b4d76e8aaba1
BINfil37a5c9060cb142eba82fd00c2b2782fd
BINfil3f6058f135ed4a97abc26dc9a4434c34
BINfil45e37540e6eb4349b021426c417d226b
BINfil59d0ab37ab314a5dafa248ba44132816
BINfil5dc30144156b48b0a76dbf96e13ec9d5
BINfil68a63a0d4a7547ae9d19c211489ea675
BINfil6f8adc2d002545708ad7859e2ecd27c4
BINfil7bab0d2fc53947efb1ba9d5877bc9bf6
BINfil7d51a848705a4325b0f576875174f86a
BINfil7f2e2ee7443a4c44a0703869c426122b
BINfila538ada59a6046ce89da48eca22f940e
BINfilafc09186440a44c1bb53df1b9e43b2f1
BINfild8626acac2414392be1dba8b612de75d
BINfilda0a221919744fa384b1a37f8e52db0c
BINfilec4836e8b0c342708506fc642b0e7d7d
BINfilf207ee258fa846b8acecd5ed9221c063
BINfilf31b33d501904bfcbe61a0bd8b88f41d
BINfilfb45c559c3e04f6a85b102aefead33f3
BINfilfcdf251a0d6f448494912362e80f2616
BINfilfd9ffac801b643d99d11f6b4f15263b4
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
%ComSphuhuhuhuhuhuhu
396f1b3ec53070261ed205db297dfdc8 › fil02e42b6aecd74e19b215988aa23929cf
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account