Malicious
MS Office Document
MD5: 3d3c42151f054f8b72c7a05dbdbece22
Size: 1.25 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
1.25 MB · 1,245,696 B
First seen
2026-08-13 05:46 · 2 months ago
Last seen
2026-08-13 05:46 · 2 months ago
Last analysis
2026-08-13 05:46 · 2 months ago
Hashes
MD5
3d3c42151f054f8b72c7a05dbdbece22
Sha1
aef67e651977baa01691f801416c39b946fe8ee1
Sha256
746151943d6e8b5705b0d19267f5d7b7d32c36d30f72bd401a9b5465ce455360
Sha384
c1305304e845f98f863a5c164bcd856f674e2f89676db18663326830c5bd1bcefe108ce6958a18ec8edc056058bad2fa
Sha512
2ac5f512a24eb0a6cba4ed230e740ee348786a50034d30642e01944f3e3249d158a43543769a12a14fdeff95904d9ae0cc7224076dbaee254c4d94726513c2a9
SSDeep
24576:TsHrJZMQ2zu1U/VNxwHcyBKQaTeR1TG2MSNpQvGA/CpjpxubejQ2B:TMrsLu10vOHBKbTe7ySNpQHCnl
TLSH
98452312E6906536C963CB380EC346D5E40C9C6EAE5EDA966B4B37AE30373F6274710D
3 malicious · 123 files
OFF3d3c42151f054f8b72c7a05dbdbece22T1221
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD000255FA
XLSPackageT1221
XML[Content_Types].xml
BINxl
BIN_rels
XMLworkbook.xml
XMLstyles.xml
BINmedia
BINtheme
BINworksheets
BINdrawings
BINembeddings
XMLsharedStrings.xml
BINexternalLinks
BIN_rels
OFFexternalLink1.xml.relsT1221
XMLexternalLink1.xml
BINprinterSettings
BINdocProps
BINCompObj
BINMBD000255FB
BINMBD000255FC
BIN_VBA_PROJECT_CUR
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 12
STICH kept: 2secondary ignored: 10
bin
4img
2oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>oox:xlsx>oox:rel:ext~T1221
Shape
ole:doc>oox:xlsx>oox:rel:ext
technique3 nodes
Path
ole:doc>oox:xlsx>oox:media>ole:doc
Shape
ole:doc>oox:xlsx>oox:media>ole:doc
4 nodes
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.4 |
| CreationDate | D:20260802130844+05'30' |
| Creator | JasperReports (OpTransactionHistoryUX5) |
| ModifiedDate | D:20260802130844+05'30' |
| Producer | iText 2.1.5 (by lowagie.com) |
| /ModDate | D:20260802130844+05'30' |
| /Creator | JasperReports (OpTransactionHistoryUX5) |
| /CreationDate | D:20260802130844+05'30' |
| /Producer | iText 2.1.5 (by lowagie.com) |
| Version | 1.7 |
| CreationDate | D:20260731145050-04'00 |
| Creator | Mozilla Firefox 153.0.1 |
| Producer | cairo 1.18.4 (https://cairographics.org) |
| /Producer | cairo 1.18.4 (https://cairographics.org) |
| /Creator | Mozilla Firefox 153.0.1 |
| /CreationDate | D:20260731145050-04'00 |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential