45a9a8cc03daaa0ad26a33c513f17869

MS Office Document

MD5: 45a9a8cc03daaa0ad26a33c513f17869

Size: 789.5 KB

application/vnd.ms-office

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

MD5	45a9a8cc03daaa0ad26a33c513f17869
Sha1	c0f72d81288e460ffe447ad5e885901346a0729d
Sha256	dac7454ad24c10672954231238187e757ee201520b9cd5ea05436a6210b78cb2
Sha384	fb1f1e5b851134231865cee81919c82dc591f99c7c35454ed566edae002e7058964a30f5887f9e1a6bf55c5aba13ed2c
Sha512	d839e7b229d75f558f19f357d868ffc3bcd015ee82ba4a84e3c5364801a95793d2b3aa91805e1baf18d8f3c8f9b15f28ee538f17bc366b9aab75509770b59181
SSDeep	12288:onl0iPc11FQwg0Cmw7i3erJFzG0QhXIH3+p4NUG0v0C343EHwgjD7:orPK1ywQ17RBCo3+pWUGC40HwgD
TLSH	DFF42248F1C10E3BDE731A7A4C9953C7683A2C458FBDD97B28893B0E15B99F31CA4466

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

9 / 9

Path ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin

Shape ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin

malicious 6 nodes

Path ole:doc~T1204~T1221>oox:xlsx>oox:media>ole:doc

Shape ole:doc>oox:xlsx>oox:media>ole:doc

malicious 4 nodes

Config. Field	Value
URL distante (OLE moniker) #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Version	1.7
Author	MTTL
CreationDate	D:20260807100803+05'30'
ModifiedDate	D:20260807100803+05'30'
Title	Order Voucher Display
Producer	Microsoft: Print To PDF
/Author	MTTL
/CreationDate	D:20260807100803+05'30'
/ModDate	D:20260807100803+05'30'
/Producer	Microsoft: Print To PDF
/Title	Order Voucher Display
Version	1.4
CreationDate	D:20260810112606-04'00'
Creator	RICOH IM 4000
ModifiedDate	D:20260810112606-04'00'
Producer	RICOH IM 4000
/CreationDate	D:20260810112606-04'00'
/ModDate	D:20260810112606-04'00'
/Creator	RICOH IM 4000
/Producer	RICOH IM 4000

Config. Field	Value
URL distante (OLE moniker) #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

You must be signed in to view YARA rules.