Malicious
Malicious

4118241b2cf74cc793e75e205a4aaa8f

Share on LinkedIn
Print
MS Office Document
MD5: 4118241b2cf74cc793e75e205a4aaa8f
Size: 36.86 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

This sample is a 36 KB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 86 embedded or derived files. It matches 105 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0
MD5
4118241b2cf74cc793e75e205a4aaa8f
Verdict
Malicious
File type
MS Office Document · 36 KB
MITRE ATT&CK
T1027T1059T1059.001T1059.005

Cite this report: https://app.malva.re/sha256/a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
36.86 KB · 36,864 B
First seen
2026-10-29 18:45 · 21 hours ago
Last seen
2026-10-29 18:45 · 21 hours ago
Last analysis
2026-10-29 18:45 · 21 hours ago
Hashes
MD5 4118241b2cf74cc793e75e205a4aaa8f Sha1 2100f3b692171ff1a0da849d098978479b7597d8 Sha256 a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0 Sha384 9927e4e053ede2bf22a3f678148eac499e142b4805bf1e3d4c3a814ad66a224a64908feaf51a0148c22922d49189cec0 Sha512 1c9e5ce811c82c0300763c1349a114f8ffc2344670a5d16a7a5e5d1ca8a35ece7842a3eb60797986a68818272c3611c84764a92a5d435461427575ea83cde86b SSDeep 768:J4MIOGTXMwlAfMGyXED1EzHQn9eWMbCbGmYtbYN/0f:2MdC/l8yIEzHQ9obIjYtf TLSH FEF26D52B5449332C9460B76091FD7E08F799C68CFA361123BDAB30C7D736E166EA8E0

61 malicious · 87 files
OFF4118241b2cf74cc793e75e205a4aaa8f
PS1Cb7ZTMFjXkTY
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
BINJ1tEhjSmu1WT
BINpOBrgrQvhPtJ
VBSuUVRMxbP5tGg
VBSuUVRMxbP5tGg.deobfuscated.vbs
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>scr:ps1~T1027~T1059.001
Shape ole:doc>scr:ps1
malicious 2 nodes
Path ole:doc>scr:vbs~T1027~T1059~T1059.005
Shape ole:doc>scr:vbs
malicious 2 nodes

Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙