Malicious
3fa32e274f64f00031ddb4930d27d776
MS Word Document
MD5: 3fa32e274f64f00031ddb4930d27d776
Size: 15.06 KB
application/msword
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 3fa32e274f64f00031ddb4930d27d776 |
| Sha1 | dfe2adf0e34241367791ab1d0e77ebd492203149 |
| Sha256 | 0a27d422d8ab0e1cc58258e431a83834239fec7285146b62e5de9b11cd3b3e9e |
| Sha384 | 1ba836fdcb1afc9b60a9ac397db0dd661731d0148cd9bae609d37d3cc45c38553964de5b5de9404fe902a9ac44736062 |
| Sha512 | b5942d5cabbe82b71c7f9051cc18255237ba35f1939fa8ad4874e54ca989cdff4be50455cbb5b194a929cd580034f3f73287e626147f2e7c4231ecc394ac13f3 |
| SSDeep | 384:/imtzIz2DgSk4DQAC78VVqmMYU6akwLWdxd4YBJI:/LGs24DQD8q10akw6LFw |
| TLSH | 6962AF2AC941B464E397023E91E901F1F32C036BD2DD2B2E5D4D76AD86213977B4C78E |
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
9 / 9
Path
oox:docm~T1027~T1047~T1059.005>bin
Shape
oox:docm>bin
technique2 nodes
Path
oox:docm~T1027~T1047~T1059.005>ole:doc
Shape
oox:docm>ole:doc
technique2 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
3fa32e274f64f00031ddb4930d27d776 › word › vbaProject.bin › Root Entry › VBA › ThisDocument › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
3fa32e274f64f00031ddb4930d27d776 › word › vbaProject.bin › Root Entry › VBA › ThisDocument › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
3fa32e274f64f00031ddb4930d27d776 › word › vbaProject.bin › Root Entry › VBA › ThisDocument › [Stored VBA]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.