Suspicious
Suspect

3e65de4a2fdfc70601a1c71429906e1f

MS Excel Document
MD5: 3e65de4a2fdfc70601a1c71429906e1f
Size: 2.46 MB
application/vnd.ms-excel

This sample is a 2.3 MB MS Excel Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 15 embedded or derived files. It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
6b77da8ced2e97869546f68b7b22e676d219f9d36f2fd3a3f3c9a510d3c807b3
MD5
3e65de4a2fdfc70601a1c71429906e1f
Verdict
Inconclusive
File type
MS Excel Document · 2.3 MB

Cite this report: https://app.malva.re/sha256/6b77da8ced2e97869546f68b7b22e676d219f9d36f2fd3a3f3c9a510d3c807b3

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
2.46 MB · 2,460,089 B
First seen
2026-10-15 12:45 · 18 days ago
Last seen
2026-10-15 12:45 · 18 days ago
Last analysis
2026-10-15 12:45 · 18 days ago
Hashes
MD5 3e65de4a2fdfc70601a1c71429906e1f Sha1 67e9cf6035cec00ee7b80967dbaad1c2d4ce0c36 Sha256 6b77da8ced2e97869546f68b7b22e676d219f9d36f2fd3a3f3c9a510d3c807b3 Sha384 21669814c9d08b5e125f2fee9cc00c803ee826cb742ec2ea5ab602ff56c611ae592a46a143cc0f83579b27846a6ca118 Sha512 0d9ac19be1ce882a096494f3a6ad91547fbd2dd46fba9fb10de7dc55877fa37dfb1268741f1f09661580a564956342028e156ac90676e29afb79682df1f9091c SSDeep 49152:IOc2yD4lTPx01JYyLZvsofUwQ1Ry3Kr2rExKgh4:IoyEFPq1zdvsG5Q1M3KrNxKgh4 TLSH A8B502BA98F269536E504663EA0F2C1A335B19E53758D342E901919C3F7B1D38F92B33

16 files
XLS3e65de4a2fdfc70601a1c71429906e1f
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
XMLsharedStrings.xml
BINtheme
XMLtheme1.xml
XMLstyles.xml
BINworksheets
XMLsheet1.xml
BIN_rels
XMLsheet1.xml.rels
BINdrawings
VMLvmlDrawing1.vml
BINembeddings
OFFzDYhC.4vR
BINRoot Entry
BIN8f9vbW
BINOle10naTIVE
BINdocProps
XMLcore.xml
XMLapp.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 1secondary ignored: 6
bin 2oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path oox:xlsx>oox:media>ole:doc
Shape oox:xlsx>oox:media>ole:doc
3 nodes

16 files
XLS3e65de4a2fdfc70601a1c71429906e1f
XML[Content_Types].xml
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙