Suspect
44babdb48b17400fdb40f9af6ea6a2eb
MS Office Document
MD5: 44babdb48b17400fdb40f9af6ea6a2eb
Size: 13.41 MB
application/vnd.ms-office
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
13.41 MB · 13,414,400 B
Hashes
MD5
44babdb48b17400fdb40f9af6ea6a2eb
Sha1
573971844ae998e76ccd8667fcb7758aa96d45bb
Sha256
b7364d80258da883201641ec32b6682e862f266de9436fb73de51931dce80692
Sha384
8b79c54bc77e20827c30aede19076acf7a6896a65a5b2ab90ffe5c7f8353cd370e3aa8ade7fc623c0f23064d33929094
Sha512
4905a7f0cd1d0a1812efe9b145858b862ca9f87652c1f2f4a30afb62e5740c928654b313a6b18a39d85a342abb2cd63c506d97dfef15dc4a71e33a8f65781946
SSDeep
196608:qHxcp9ym3nltDUJVWHxcp9ym3DHxcp9ym3HHxcp9ym3CHxcp9ym3gHxcp9ym3AHx:4GplpBGptGpxGpQGpOGpuGpa
TLSH
ECD623116BF89678F0F22A35E876A0B1A5377D125E22D12E2324791E2C75EC0C9B3777
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 13
STICH kept: 3secondary ignored: 10
bin
9img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
ole:doc>pe:dll>pe:dll>pe:dll
Shape
ole:doc>pe:dll>pe:dll>pe:dll
4 nodes
Path
ole:doc>pe:dll>pe:dll
Shape
ole:doc>pe:dll>pe:dll
3 nodes
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
No malware configuration was found at this point.
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
44babdb48b17400fdb40f9af6ea6a2eb › Root Entry › 䌋䄱䜵㬾䖸䒷㪰䗦䒬㵱䅬䄵䜵 › ScreenConnect.Windows.dll
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.