Malicious
39cc6af95d0425f160571032a6719ad3
MS Word Document
MD5: 39cc6af95d0425f160571032a6719ad3
Size: 39.81 KB
application/msword
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 39cc6af95d0425f160571032a6719ad3 |
| Sha1 | 512920c5e31d08d65940877bdb29d0a17738ce37 |
| Sha256 | 49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495 |
| Sha384 | 6ef662102ed63a64c81d59a5fccb030d98ba2e9a38d92e28215a76f23b18e1adf686f2c75a7e8530244d00d39d147720 |
| Sha512 | 0cc2d31c10d9628b6179c21470ce376724ec59c55f7b1ef54a48699cb451d27b728f6cf6e855c7bebacc7e12fb496ab1aefd0c187aaacd52427e35727bcb50a8 |
| SSDeep | 768:LhO+wq8snuiaB3w+rxCNOOa4p4NxllNRJ6DLeBkEuUESPKMU:oq3nuiaB3fAoGMBrJseWEuUESE |
| TLSH | BB03D07CF558B40AE6928E3C96640BE8F12407C6F231E4AE5506FB9C5B658CB634398D |
Malicious
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 11
STICH kept: 5secondary ignored: 6
bin
1img
1oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
5 / 5
Path
oox:docm>oox:vba~T1027~T1059.005
Shape
oox:docm>oox:vba
malicious
2 nodes
Path
oox:docm>ole:doc~T1059.005
Shape
oox:docm>ole:doc
technique2 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URLs in VB Code - #2
URIsuspect
httpshuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #1
PATHmalicious
%userphuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #2
PATHmalicious
%userphuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #3
PATHmalicious
%userphuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #4
PATHmalicious
%userphuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #5
PATHmalicious
%userphuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #6
PATHmalicious
%userphuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 9huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
Malicious
| Config. Field | Value |
|---|---|
| URL (COM trace) #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URLs in VB Code - #2
URIsuspect
httpshuhuhuhuhuhuhu
39cc6af95d0425f160571032a6719ad3 › word › vbaProject.bin
URLs in VB Code - #4
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
39cc6af95d0425f160571032a6719ad3 › word › vbaProject.bin
Dropped path (COM trace) #1
PATHmalicious
%userphuhuhuhuhuhuhuhuhuhuhu
39cc6af95d0425f160571032a6719ad3 › word › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA]
Dropped path (COM trace) #2
PATHmalicious
%userphuhuhuhuhuhuhuhuhuhuhu
39cc6af95d0425f160571032a6719ad3 › word › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA]
Dropped path (COM trace) #3
PATHmalicious
%userphuhuhuhuhuhuhuhuhuhuhu
39cc6af95d0425f160571032a6719ad3 › word › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA]
Dropped path (COM trace) #4
PATHmalicious
%userphuhuhuhuhuhuhuhuhuhuhu
39cc6af95d0425f160571032a6719ad3 › word › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA]
Dropped path (COM trace) #5
PATHmalicious
%userphuhuhuhuhuhuhuhuhuhuhu
39cc6af95d0425f160571032a6719ad3 › word › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA]
Dropped path (COM trace) #6
PATHmalicious
%userphuhuhuhuhuhuhuhuhuhuhu
39cc6af95d0425f160571032a6719ad3 › word › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 9huhuhuhuhuhuhuhuhuhuhu
39cc6af95d0425f160571032a6719ad3 › word › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA]
Remote Resource Reference
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
39cc6af95d0425f160571032a6719ad3 › word › _rels › document.xml.rels
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.