Malicious
Malicious

4118241b2cf74cc793e75e205a4aaa8f

MS Office Document
MD5: 4118241b2cf74cc793e75e205a4aaa8f
Size: 36.86 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

This sample is a 36 KB MS Office Document classified as malicious by Malva.RE. Static analysis extracted 86 embedded or derived files. It matches 105 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0
MD5
4118241b2cf74cc793e75e205a4aaa8f
Verdict
Malicious
File type
MS Office Document · 36 KB
MITRE ATT&CK
T1027T1059T1059.001T1059.005

Cite this report: https://app.malva.re/sha256/a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
36.86 KB · 36,864 B
First seen
2026-10-29 18:45 · 22 hours ago
Last seen
2026-10-29 18:45 · 22 hours ago
Last analysis
2026-10-29 18:45 · 22 hours ago
Hashes
MD5 4118241b2cf74cc793e75e205a4aaa8f Sha1 2100f3b692171ff1a0da849d098978479b7597d8 Sha256 a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0 Sha384 9927e4e053ede2bf22a3f678148eac499e142b4805bf1e3d4c3a814ad66a224a64908feaf51a0148c22922d49189cec0 Sha512 1c9e5ce811c82c0300763c1349a114f8ffc2344670a5d16a7a5e5d1ca8a35ece7842a3eb60797986a68818272c3611c84764a92a5d435461427575ea83cde86b SSDeep 768:J4MIOGTXMwlAfMGyXED1EzHQn9eWMbCbGmYtbYN/0f:2MdC/l8yIEzHQ9obIjYtf TLSH FEF26D52B5449332C9460B76091FD7E08F799C68CFA361123BDAB30C7D736E166EA8E0

61 malicious · 87 files
OFF4118241b2cf74cc793e75e205a4aaa8f
BINRoot Entry
BIN䡀䌏䈯
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䋜䕲䆷䗸
BIN䡀䕙䓲䕨䜷
BIN䕙䇲䆸䞷䄦䠥
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
PS1Cb7ZTMFjXkTY
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
BINJ1tEhjSmu1WT
BINpOBrgrQvhPtJ
VBSuUVRMxbP5tGg
VBSuUVRMxbP5tGg.deobfuscated.vbs
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>scr:ps1~T1027~T1059.001
Shape ole:doc>scr:ps1
malicious 2 nodes
Path ole:doc>scr:vbs~T1027~T1059~T1059.005
Shape ole:doc>scr:vbs
malicious 2 nodes

Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

61 malicious · 87 files
OFF4118241b2cf74cc793e75e205a4aaa8f
PS1Cb7ZTMFjXkTY
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
BINJ1tEhjSmu1WT
BINpOBrgrQvhPtJ
VBSuUVRMxbP5tGg
VBSuUVRMxbP5tGg.deobfuscated.vbs
No malware configuration was found at this point.

Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
4118241b2cf74cc793e75e205a4aaa8f › uUVRMxbP5tGg
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙