Malicious
Malicious

449d6415d57aea346e9cfd765b51108f

MS Office Document
MD5: 449d6415d57aea346e9cfd765b51108f
Size: 1.16 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 449d6415d57aea346e9cfd765b51108f
Sha1 8fb5cd02d8ed88373010c1db6b53d7eb58df565d
Sha256 72340d984e5018ea2763ab0125354ecbab45261bf3d9f241bca875b0ed2c9998
Sha384 68cb94ef532441366c3cb46a696ffef2ab325c94d4ed838675d9ca1bcbaad7a90ee5596774f17ab1737496d4c86c2d56
Sha512 70e50caebb510f9bc8acba3aeec4461093ebb2b86a0cdea15bd44e17befd974ea1b6c5b326b3ff39c08ccc55d509d30dd4189838c2fc525334e01139e42318ff
SSDeep 12288:byvJCdiPB5bDg1CkTPMyAouhyV70SvqrPOG1XtbCItT65Iq5Hb21+4KI0F3iJFN1:upEBObUV1SjOG1XtbxGdbN4KYmLo+2R
TLSH 8435B0E83540EF5CD3B54BB205FF76DD8DE01D33963079685422B2826D3A7F92D6A80A
449d6415d57aea346e9cfd765b51108f
Malicious
file_19DDD240D43A
Root Entry
Malicious
䡀䌏䈯
䄦㡥䆾䅤
䡀䈖䌧䠤
䡀䌋䄱䜵
䡀㬿䏲䐸䖱
䡀㽿䅤䈯䠶
䡀䈏䗤䕸䠨
䡀䓞䕪䇤䠨
䡀䕙䓲䕨䜷
䡀䌍䈵䗦䕲䠼
䡀䒌䓰䑲䑨䠷
䡀㼿䕷䑬㭪䗤䠤
䡀㼿䕷䑬㹪䒲䠯
䡀㿿䏤䇬䗤䒬䠱
䡀䖖㯬䏬㱨䖤䠫
䡀䘌䗶䐲䆊䌷䑲
䡀䄕䑸䋦䒌䇱䗬䒬䠱
䡀䇊䌰㾱㼒䔨䈸䆱䠨
䌋䄱䜵㬾䕲㪨䇸䒬㩂㣈
䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
䌋䄱䜵㲾䗱䄙䄵䏯䏨㤂㢇
䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁
Malicious
䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁
Malicious
.executed
Malicious
.subscript.vbs
Malicious
SummaryInformation
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>scr:vbs~T1027~T1059.005
Shape ole:doc>scr:vbs
malicious 2 nodes
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
449d6415d57aea346e9cfd765b51108f
Malicious
file_19DDD240D43A
Root Entry
Malicious
䡀䌏䈯
䄦㡥䆾䅤
䡀䈖䌧䠤
䡀䌋䄱䜵
䡀㬿䏲䐸䖱
䡀㽿䅤䈯䠶
䡀䈏䗤䕸䠨
䡀䓞䕪䇤䠨
䡀䕙䓲䕨䜷
䡀䌍䈵䗦䕲䠼
䡀䒌䓰䑲䑨䠷
䡀㼿䕷䑬㭪䗤䠤
䡀㼿䕷䑬㹪䒲䠯
䡀㿿䏤䇬䗤䒬䠱
䡀䖖㯬䏬㱨䖤䠫
䡀䘌䗶䐲䆊䌷䑲
䡀䄕䑸䋦䒌䇱䗬䒬䠱
䡀䇊䌰㾱㼒䔨䈸䆱䠨
䌋䄱䜵㬾䕲㪨䇸䒬㩂㣈
䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
䌋䄱䜵㲾䗱䄙䄵䏯䏨㤂㢇
䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁
Malicious
䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁
Malicious
.executed
Malicious
.subscript.vbs
Malicious
SummaryInformation
No malware configuration was found at this point.
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
449d6415d57aea346e9cfd765b51108f › Root Entry › 䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
449d6415d57aea346e9cfd765b51108f › Root Entry › 䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁 › 䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁 › .executed › .subscript.vbs
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
449d6415d57aea346e9cfd765b51108f › Root Entry › 䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁 › 䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁 › .executed › .subscript.vbs
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
449d6415d57aea346e9cfd765b51108f › Root Entry › 䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁 › 䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁 › .executed › .subscript.vbs
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
449d6415d57aea346e9cfd765b51108f › Root Entry › 䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁 › 䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁 › .executed › .subscript.vbs
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
449d6415d57aea346e9cfd765b51108f › Root Entry › 䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁 › 䌋䄱䜵㽾䒲䅯䕤䈐䈱䄵㡯㥁䠁 › .executed › .subscript.vbs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙