Suspicious
Suspect

3f7d7ee50786368466a7adf7fcaddec7

MS Word Document
MD5: 3f7d7ee50786368466a7adf7fcaddec7
Size: 34.58 KB
application/msword

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 3f7d7ee50786368466a7adf7fcaddec7
Sha1 7099126ab6d469e203fce750d571c2fd9bba371b
Sha256 faf48d06765f7d2f06362e262f33a2f8db89fe857b39f8697d584e43d8c15325
Sha384 d8753125ff8b621c4b7e602221f5a4cbacc9a95af33734e4db9a03b5ba2b8017495ca2564bf3989312a2261991f6bbbf
Sha512 7a72f50fad277cc0605e309bfb6da24bde982d9bfc353679bdda1668fc13cf8004a49fb45d6bb88124145579226faeab7cd73a5a558ee131e77c7a03e51cfc8f
SSDeep 768:o5O31X1to03Y4hc5zt5VZhQN9tpL81VtEKDk:o5Grto03Yic5BU3tJ81V6KDk
TLSH E0F2AF17E201F833CB2CC47D9C5504FEE79FAA0804629E2DE552936C8D61657AFABC8D
3f7d7ee50786368466a7adf7fcaddec7
[Content_Types].xml
_rels
.rels
word
document.xml
_rels
media
image1.PNG
image1.PNG-preview.png
theme
theme1.xml
settings.xml
styles.xml
webSettings.xml
fontTable.xml
docProps
core.xml
app.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 6 STICH kept: 1secondary ignored: 5
img 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path oox:docx>oox:rel:ext
Shape oox:docx>oox:rel:ext
2 nodes
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
3f7d7ee50786368466a7adf7fcaddec7
[Content_Types].xml
_rels
.rels
word
document.xml
_rels
media
image1.PNG
image1.PNG-preview.png
theme
theme1.xml
settings.xml
styles.xml
webSettings.xml
fontTable.xml
docProps
core.xml
app.xml
No malware configuration was found at this point.
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
3f7d7ee50786368466a7adf7fcaddec7 › word › _rels › document.xml.rels
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙