3d507cbdc165d027a30b32cb1193fc60

MS Office Document

MD5: 3d507cbdc165d027a30b32cb1193fc60

Size: 1.12 MB

application/vnd.ms-office

Ctrl + scroll to zoom · drag to pan

This sample is a 1.1 MB MS Office Document classified as malicious by Malva.RE. Static analysis extracted 45 embedded or derived files and a malware configuration (Template/objet distant (CVE-2017-0199)). It matches 4 YARA rules. Observed behaviours map to MITRE ATT&CK T1204 and T1221. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: d1c9958be594644dd0f0be1351f7a95ef6ee96b13617741046be1599978cd5d8
MD5: 3d507cbdc165d027a30b32cb1193fc60
Verdict: Malicious
File type: MS Office Document · 1.1 MB
MITRE ATT&CK: T1204 T1221

Cite this report: https://app.malva.re/sha256/d1c9958be594644dd0f0be1351f7a95ef6ee96b13617741046be1599978cd5d8

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

1.12 MB · 1,120,256 B

First seen

2026-11-02 14:15 · 6 hours ago

Last seen

2026-11-02 14:15 · 6 hours ago

Last analysis

2026-11-02 14:15 · 6 hours ago

Hashes

MD5 3d507cbdc165d027a30b32cb1193fc60 Sha1 88893322f00d85b630eeb97116d4a4df80649707 Sha256 d1c9958be594644dd0f0be1351f7a95ef6ee96b13617741046be1599978cd5d8 Sha384 f90b7cfb79d02909f2c8f2f5239fce9fe99ea50a81ca7ea75323966875e6a9d399be601e23c0797eb9adbd67c9dc9f1f Sha512 1e3ebd8aed79109c74a20c37a0d15bd69b0372e5485a70455e862e4b5a3a84d62a73b1b7fa591d848fda175f33ebe5d0131e1b7ccbf8ed3bc1ac4b92f1987f78 SSDeep 24576:no1h0M9FI6FDj5e6bjDq+lt7I0R0g8PI0NPyWp0iK6LNsNvel:EjTDj5e6fDzk88NGz6LeN TLSH 55352305F19ADB12D4215A3C6CC3F806E69AFE408DA6C8973755FB0CA9B4BB513D710E

1 malicious · 46 files

OFF3d507cbdc165d027a30b32cb1193fc60CVE-2017-0199

BINRoot Entry

BINCompObj

BINWorkbook

BINSummaryInformation

BINDocumentSummaryInformation

BINMBD00F8B007

XLSPackage

XML[Content_Types].xml

BIN_rels

XML.rels

BINxl

BIN_rels

XMLworkbook.xml.rels

XMLworkbook.xml

BINtheme

XMLtheme1.xml

BINworksheets

XMLsheet2.xml

BIN_rels

XMLsheet1.xml.rels

XMLsheet2.xml.rels

XMLsheet3.xml.rels

XMLsheet3.xml

XMLsheet1.xml

BINdrawings

BIN_rels

XMLdrawing1.xml.rels

XMLvmlDrawing1.vml.rels

XMLdrawing1.xml

VMLvmlDrawing1.vml

XMLstyles.xml

XMLsharedStrings.xml

BINmedia

EMFimage2.emf

IMGimage1.png

IMGimage1.png-preview.png

BINembeddings

OFFoleObject1.bin

BINRoot Entry

BINOle

BINCompObj

PDFCONTENTS

BINText (Preview)

TXTPage #1

IMG#Stream obj 4 0

IMG#Stream obj 4 0-preview.png

BIN#Stream obj 5 0

TXTStructure

BINprinterSettings

BINprinterSettings1.bin

BINprinterSettings3.bin

BINprinterSettings2.bin

BINdocProps

XMLcore.xml

XMLapp.xml

BINCompObj

BINMBD00F8B008

BINOle

BIN_VBA_PROJECT_CUR

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

BIN_VBA_PROJECT

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

11 / 11

Path ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>img

Shape ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>img

malicious 6 nodes

Path ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin

Shape ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin

malicious 6 nodes

Config. Field	Value
URL distante (OLE moniker) #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Version	1.4
CreationDate	D:20261004071709+02'00'
Creator	RICOH MP C2011
ModifiedDate	D:20261004071709+02'00'
Producer	RICOH MP C2011
/CreationDate	D:20261004071709+02'00'
/ModDate	D:20261004071709+02'00'
/Creator	RICOH MP C2011
/Producer	RICOH MP C2011

1 malicious · 46 files

OFF3d507cbdc165d027a30b32cb1193fc60CVE-2017-0199

BINRoot Entry

Config. Field	Value
URL distante (OLE moniker) #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

3d507cbdc165d027a30b32cb1193fc60

Overview

Summary by MalvaGPT

Characteristics

File Structure

Malware Configuration — Template/objet distant (CVE-2017-0199)1

Information9

3d507cbdc165d027a30b32cb1193fc60 (1.12 MB)

File Structure

Malware Configuration — Template/objet distant (CVE-2017-0199)1