Suspect
46449649adaac992cef68137a429091f
MS Office Document
MD5: 46449649adaac992cef68137a429091f
Size: 752.13 KB
application/vnd.ms-office
This sample is a 734.5 KB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 75 embedded or derived files. It matches 4 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 1dec99fe32389748659b03568a0a7a7b252e2147627104025edf1bc399f88888
- MD5
- 46449649adaac992cef68137a429091f
- Verdict
- Inconclusive
- File type
- MS Office Document · 734.5 KB
Cite this report: https://app.malva.re/sha256/1dec99fe32389748659b03568a0a7a7b252e2147627104025edf1bc399f88888
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
752.13 KB · 752,128 B
First seen
2026-08-14 07:46 · 2 months ago
Last seen
2026-08-14 07:46 · 2 months ago
Last analysis
2026-08-14 07:46 · 2 months ago
Hashes
MD5
46449649adaac992cef68137a429091f
Sha1
462550472a216cfca82b07e4999217f0f404d2fa
Sha256
1dec99fe32389748659b03568a0a7a7b252e2147627104025edf1bc399f88888
Sha384
db446da9a28e53cec87b6e6b2eaa49461702cb52bb89914e676fba9184c601d1b8fa470046e0ffbb3e987e0afe7e4583
Sha512
c1b868794cf27f9e02401835572068198c65a77377eb5551f69edec69136b45d8ed802ce275daf5ec40ce413204112fe4c31f1b96cab9faa7233e4fa9eea1cd8
SSDeep
12288:QvAjvB/h65J3WyLl6rk5jyb8iX5eRsWAD7Z6CS37B/hmjxP/P7dorDY/cViy+Vlo:xjvBo5JGyRiwjy9xv8fdFPsc4yoc59gk
TLSH
BAF42359F7C2D924E607A4B914C19956036E7C36EE12C72F3102B70D6275BEB63E832E
76 files
OFF46449649adaac992cef68137a429091f
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD003C243C
XLSPackage
XML[Content_Types].xml
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
XMLsharedStrings.xml
BINtheme
XMLtheme1.xml
BINworksheets
BIN_rels
XMLsheet1.xml.rels
XMLsheet1.xml
BINdrawings
BIN_rels
XMLvmlDrawing1.vml.rels
XMLdrawing1.xml
VMLvmlDrawing1.vml
XMLstyles.xml
BINmedia
EMFimage2.emf
IMGimage1.png
IMGimage1.png-preview.png
BINembeddings
OFFoleObject1.bin
BINRoot Entry
BINOle
BINCompObj
PDFCONTENTS
BINText (Preview)
TXTPage #1
BIN#Stream obj 11 0
BIN#Stream obj 9 0
BIN#Stream obj 14 0
BIN#Stream obj 10 0
BIN#Stream obj 18 0
BIN#Stream obj 19 0
BIN#Stream obj 20 0
BIN#Stream obj 8 0
BIN#Stream obj 22 0
TXTStructure
BINprinterSettings
BINprinterSettings1.bin
BINdocProps
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD003C243D
XLSPackage
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
BINworksheets
XMLsheet4.xml
XMLsheet3.xml
XMLsheet2.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet4.xml.rels
XMLsheet1.xml
XMLsheet5.xml
BINdrawings
BIN_rels
XMLdrawing1.xml.rels
XMLdrawing2.xml.rels
XMLdrawing2.xml
XMLdrawing1.xml
BINcharts
BIN_rels
XMLchart1.xml.rels
XMLchart1.xml
XMLcolors1.xml
XMLstyle1.xml
BINtheme
XMLtheme1.xml
XMLstyles.xml
XMLsharedStrings.xml
BINmedia
IMGimage1.png
IMGimage1.png-preview.png
BINprinterSettings
BINprinterSettings2.bin
BINprinterSettings4.bin
BINprinterSettings1.bin
BINdocProps
XMLcore.xml
XMLapp.xml
BINMBD003C243E
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 10
STICH kept: 1secondary ignored: 9
bin
4img
1oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>oox:xlsx>oox:media>ole:doc
Shape
ole:doc>oox:xlsx>oox:media>ole:doc
4 nodes
| Name | Value |
|---|---|
| Version | 1.7 |
| Author | Labotronics Scientific |
| CreationDate | D:20260731103220+05'30' |
| Creator | Labotronics Scientific |
| Keywords | Quotation | Labotronics Scientific |
| ModifiedDate | D:20260731103220+05'30' |
| Subject | Quotation |
| Title | LABOT20260731102706 |
| Producer | TCPDF 6.6.5 (http://www.tcpdf.org) |
| /Title | LABOT20260731102706 |
| /Author | Labotronics Scientific |
| /Subject | Quotation |
| /Keywords | Quotation | Labotronics Scientific |
| /Creator | Labotronics Scientific |
| /Producer | TCPDF 6.6.5 (http://www.tcpdf.org) |
| /CreationDate | D:20260731103220+05'30' |
| /ModDate | D:20260731103220+05'30' |
URI
URI
http:/huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential76 files
OFF46449649adaac992cef68137a429091f
BINRoot Entry
No malware configuration was found at this point.
URI
URI
http:/huhuhuhuhuhuhu
46449649adaac992cef68137a429091f › Root Entry › MBD003C243C › Package › xl › embeddings › oleObject1.bin › Root Entry › CONTENTS
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account