Malicious
3d7a711daaad06e25f84aade4ae4c0db
MS Office Document
MD5: 3d7a711daaad06e25f84aade4ae4c0db
Size: 290.82 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
290.82 KB · 290,816 B
First seen
2026-09-29 10:15 · 26 days ago
Last seen
2026-09-29 10:15 · 26 days ago
Last analysis
2026-09-29 10:15 · 26 days ago
Hashes
MD5
3d7a711daaad06e25f84aade4ae4c0db
Sha1
e5717f7edaa674b77bf58bf69383db16836dbb61
Sha256
789ba8885841786c1b3aeb4c1c5c75a3757155d160029f490dbfe724dce61fe9
Sha384
311e4b055b413b521ebe42cafd345baa3e97032788fc8d54298d7e246d0bc805be17e268ebaf86ed07c007e78357eeab
Sha512
1272c420c9bbf709cdaf776452745eb91c1e977c5c4ee3654329c3a40ffebe575b27054cb342305caa8a5c2f4c0b7d808d6d42504d7397826e5deb5d044ddfe6
SSDeep
3072:d6iqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:dphy8VKU3hvZUy+ppHEsuB/
TLSH
95549D217490503AEBFF0932953AD671AE3DFE280B50C56EC384B91E1E719C167B3B66
23 malicious · 52 files
OFF3d7a711daaad06e25f84aade4ae4c0dbT1027 · T1047 · T1059
PS1BootLauncherPs1FileT1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1BootstrapPs1FileT1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1MonitorPs1FileT1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
BINRoot Entry
BIN䡀䌏䈯
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䘲䈷䞵䄦䠥
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
EXE䌋䄱䜵䀾䛬㪌
Structure
P7B[Authenticode]_9382666f.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
PS1䡀㼿䕷䑬㭪䗤䠤T1027 · T1047 · T1059
VBS䡀㼿䕷䑬㭪䗤䠤.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN䡀㼿䕷䑬㭪䗤䠤.comtrace
SH[Command #1]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINDigitalSignature
BINSummaryInformation
BINMsiDigitalSignatureEx
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 8
STICH kept: 5secondary ignored: 3
bin
3Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
5 / 5
Path
ole:doc>scr:ps1~T1027~T1047~T1059~T1059.001~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:ps1>scr:bat>scr:ps1
malicious
4 nodes
Path
ole:doc>scr:ps1~T1027~T1047~T1059~T1059.001~T1059.005>scr:vbs~T1059.005>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:ps1>scr:vbs>scr:ps1
malicious
4 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #1
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
servichuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential23 malicious · 52 files
OFF3d7a711daaad06e25f84aade4ae4c0dbT1027 · T1047 · T1059
PS1BootLauncherPs1FileT1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1BootstrapPs1FileT1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1MonitorPs1FileT1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
BINRoot Entry
BIN䡀䌏䈯
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䘲䈷䞵䄦䠥
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
EXE䌋䄱䜵䀾䛬㪌
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
PS1䡀㼿䕷䑬㭪䗤䠤T1027 · T1047 · T1059
VBS䡀㼿䕷䑬㭪䗤䠤.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN䡀㼿䕷䑬㭪䗤䠤.comtrace
SH[Command #1]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINDigitalSignature
BINSummaryInformation
BINMsiDigitalSignatureEx
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
3d7a711daaad06e25f84aade4ae4c0db › MonitorPs1File
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
3d7a711daaad06e25f84aade4ae4c0db › BootstrapPs1File
Command (COM trace) #1
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
3d7a711daaad06e25f84aade4ae4c0db › Root Entry › 䡀㼿䕷䑬㭪䗤䠤
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhuhuhuhuhu
3d7a711daaad06e25f84aade4ae4c0db › Root Entry › 䡀㼿䕷䑬㭪䗤䠤
Deobfuscated PowerShell
UNKNWOWNmalicious
servichuhuhuhuhuhuhuhuhuhuhu
3d7a711daaad06e25f84aade4ae4c0db › Root Entry › 䡀㼿䕷䑬㭪䗤䠤 › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account