Suspect
4955ad9d29b4789784de6effee9e9792
MS Office Document
MD5: 4955ad9d29b4789784de6effee9e9792
Size: 13.59 MB
application/vnd.ms-office
This sample is a 13 MB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 98 embedded or derived files. It matches 7 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 7281c360399e7124638f35040995dc417f2f6591f01522a9230105831d1d513d
- MD5
- 4955ad9d29b4789784de6effee9e9792
- Verdict
- Inconclusive
- File type
- MS Office Document · 13 MB
Cite this report: https://app.malva.re/sha256/7281c360399e7124638f35040995dc417f2f6591f01522a9230105831d1d513d
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
13.59 MB · 13,586,432 B
First seen
2026-10-21 21:46 · 7 days ago
Last seen
2026-10-21 21:46 · 7 days ago
Last analysis
2026-10-21 21:46 · 7 days ago
Hashes
MD5
4955ad9d29b4789784de6effee9e9792
Sha1
46c706d10108c197ff3e6bc9e2fb27ce6d056243
Sha256
7281c360399e7124638f35040995dc417f2f6591f01522a9230105831d1d513d
Sha384
d0edb16b444e1b42932ff813f94b8a136149ca9f32c33ebea49c9b056a6a39986b5de9e030b323dbbd5237ef328d4795
Sha512
b416d5f70ed8d83fe98cb6161d09af2d7fef0cc316b541ef653b9ec051711aeab84272bdce76645299a46b4355b26928bc2d6e7d15ecfc3656cc19892884591a
SSDeep
196608:brCbaPLYRCyaMYumVVVfAmYCAqtC0aDmmt8QRXG4FWW+7TBYYQqAzKn0KSxa:mDJavDVYmYQtCbmmt3/3gFAfKSM
TLSH
D3D633E01FC5ABD5D6A69178E1E24558D0E2BC71C916B41BFE81FAB10E33D6602F81BC
99 files
OFF4955ad9d29b4789784de6effee9e9792
BINRoot Entry
BIN䡀䌏䈯
BIN䄦㡥䆾䅤
BINRvToolsMsi
OFFRmmMsiFile
BINRoot Entry
BIN䡀䆒䑲
BIN䡀䌏䈯
BIN䄦㡥䆾䅤
BIN䡀㲞䈝䗻
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀䌍䏤䊲
BIN䡀䕎䒵䠵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䋌䆨㫮䛲
BIN䡀䒌䗱䒵䠯
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
EXE䌋䄱䜵䀾䛬㪌
Structure
P7B[Authenticode]_9382666f.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
BIN䡀䆊䌷䑲䈝䗻
BIN䡀䈛㵪䆲䗤䕲
BIN䡀䈝䗻䗜䏼䠨
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀䓊㼳䄨䆵䠫
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䄛䌧㫲䗸䒷䠱
BIN䡀䒌䗱䒵㮯䈹䗱
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䙎䑨㶷䓤䌳䊱
BIN䆒䑲㹾䒵䘧䗦䆒䑲
EXE䌋䄱䜵㪾㬁䐲䒰䠱
Structure
P7B[Authenticode]_600dfee1.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BIN䡀䈜䙵䆬㬨䑲䌩䠪
BIN䡀䈜䙵䆬㬨䑲䕷䏲
BIN䡀䈜䙵䆬㲨䖱䄷䏯
EXE䌋䄱䜵䀾䛬㲞䌠䆻䠤
Structure
P7B[Authenticode]_ddcfac7b.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䒌䗱䒵㬯䑲䌧䌷䑲
BIN䌋䄱䜵䀾䛬㲞㫿䓰㷿䚨
BIN䌋䄱䜵䀾䛬㲞㫿䓰㾿䠳
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䌋䄱䜵䀾䛬㲞㲿䒦㲿䉱䠲
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䌋䄱䜵䀾䛬㲞㫿䓰㫿䑤䈱䠵
BIN䌋䄱䜵䀾䛬㲞㫿䓰㭿䄬䒯䠪
BIN䌋䄱䜵䀾䛬㲞㲿䒦㮿䆻䄯䠰
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINDigitalSignature
BINSummaryInformation
BINMsiDigitalSignatureEx
EXEa1_7z_dll_file
P7B[Authenticode]_339a5a70.p7b
BINa1_sas_dll_file
BINaction1_remote_exe
BINmain_service_exe
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
EXE䌋䄱䜵㼾䏬䑨㻷䑸䛎䠨
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINDigitalSignature
BINSummaryInformation
BINMsiDigitalSignatureEx
BINRvToolsMsi
BINRmmMsiFile
STICH
beta
No STICH Path has been generated for this analysis yet.
6 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.
bin
6PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential99 files
OFF4955ad9d29b4789784de6effee9e9792
BINRoot Entry
BINRvToolsMsi
BINRmmMsiFile
No malware configuration was found at this point.
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
4955ad9d29b4789784de6effee9e9792 › Root Entry › 䄦㡥䆾䅤 › RmmMsiFile › a1_7z_dll_file
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account