Suspect
4eb98e169da96cbc1ee64b0b7ae211a5
MS Office Document
MD5: 4eb98e169da96cbc1ee64b0b7ae211a5
Size: 752.13 KB
application/vnd.ms-office
This sample is a 734.5 KB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 75 embedded or derived files. It matches 4 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- c5fa4668a918ce5753b54b5cf89160a0fd03ece2bab29029789a9b565348cb2d
- MD5
- 4eb98e169da96cbc1ee64b0b7ae211a5
- Verdict
- Inconclusive
- File type
- MS Office Document · 734.5 KB
Cite this report: https://app.malva.re/sha256/c5fa4668a918ce5753b54b5cf89160a0fd03ece2bab29029789a9b565348cb2d
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
752.13 KB · 752,128 B
First seen
2026-08-14 07:46 · 2 months ago
Last seen
2026-08-14 07:46 · 2 months ago
Last analysis
2026-08-14 07:46 · 2 months ago
Hashes
MD5
4eb98e169da96cbc1ee64b0b7ae211a5
Sha1
92bb8235e2bfa4bf755325edfddc48ae422dc0c8
Sha256
c5fa4668a918ce5753b54b5cf89160a0fd03ece2bab29029789a9b565348cb2d
Sha384
e243449c9574d57efbcee06ce7e8f829b7f5ac139c71714ee706cddf5f8892b9487063e32cbc60d6a5755493061030d4
Sha512
6b810b826add02aa3846e7064c84424d646ba95e540ff9b4b856fac2d9d3794a55187cf5c31ba292e5b8ea25f9e80f4bc3450cb0ab167c08222bf0164e48d30d
SSDeep
12288:gvAjvB/h65J3WyLl6rk5jyb8iX5eRsWAD7Z6CS67B/QG5y2PkTPa8dWoXYWZxWiy:BjvBo5JGyRiwjy9xv8fuH5y2ICiWoXYf
TLSH
F8F42325F7C2D514C307C4B849C2DC16826D7C65BE26EA1F3685F70D91B17EA83EA26C
76 files
OFF4eb98e169da96cbc1ee64b0b7ae211a5
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD0041E154
XLSPackage
XML[Content_Types].xml
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
XMLsharedStrings.xml
BINtheme
XMLtheme1.xml
BINworksheets
BIN_rels
XMLsheet1.xml.rels
XMLsheet1.xml
BINdrawings
BIN_rels
XMLvmlDrawing1.vml.rels
XMLdrawing1.xml
VMLvmlDrawing1.vml
XMLstyles.xml
BINmedia
EMFimage2.emf
IMGimage1.png
IMGimage1.png-preview.png
BINembeddings
OFFoleObject1.bin
BINRoot Entry
BINOle
BINCompObj
PDFCONTENTS
BINText (Preview)
TXTPage #1
BIN#Stream obj 11 0
BIN#Stream obj 9 0
BIN#Stream obj 14 0
BIN#Stream obj 10 0
BIN#Stream obj 18 0
BIN#Stream obj 19 0
BIN#Stream obj 20 0
BIN#Stream obj 8 0
BIN#Stream obj 22 0
TXTStructure
BINprinterSettings
BINprinterSettings1.bin
BINdocProps
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD0041E155
XLSPackage
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
BINworksheets
XMLsheet4.xml
XMLsheet3.xml
XMLsheet2.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet4.xml.rels
XMLsheet1.xml
XMLsheet5.xml
BINdrawings
BIN_rels
XMLdrawing1.xml.rels
XMLdrawing2.xml.rels
XMLdrawing2.xml
XMLdrawing1.xml
BINcharts
BIN_rels
XMLchart1.xml.rels
XMLchart1.xml
XMLcolors1.xml
XMLstyle1.xml
BINtheme
XMLtheme1.xml
XMLstyles.xml
XMLsharedStrings.xml
BINmedia
IMGimage1.png
IMGimage1.png-preview.png
BINprinterSettings
BINprinterSettings2.bin
BINprinterSettings4.bin
BINprinterSettings1.bin
BINdocProps
XMLcore.xml
XMLapp.xml
BINMBD0041E156
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 10
STICH kept: 1secondary ignored: 9
bin
4img
1oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>oox:xlsx>oox:media>ole:doc
Shape
ole:doc>oox:xlsx>oox:media>ole:doc
4 nodes
| Name | Value |
|---|---|
| Version | 1.7 |
| Author | Labotronics Scientific |
| CreationDate | D:20260731103220+05'30' |
| Creator | Labotronics Scientific |
| Keywords | Quotation | Labotronics Scientific |
| ModifiedDate | D:20260731103220+05'30' |
| Subject | Quotation |
| Title | LABOT20260731102706 |
| Producer | TCPDF 6.6.5 (http://www.tcpdf.org) |
| /Title | LABOT20260731102706 |
| /Author | Labotronics Scientific |
| /Subject | Quotation |
| /Keywords | Quotation | Labotronics Scientific |
| /Creator | Labotronics Scientific |
| /Producer | TCPDF 6.6.5 (http://www.tcpdf.org) |
| /CreationDate | D:20260731103220+05'30' |
| /ModDate | D:20260731103220+05'30' |
URI
URI
http:/huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential76 files
OFF4eb98e169da96cbc1ee64b0b7ae211a5
BINRoot Entry
No malware configuration was found at this point.
URI
URI
http:/huhuhuhuhuhuhu
4eb98e169da96cbc1ee64b0b7ae211a5 › Root Entry › MBD0041E154 › Package › xl › embeddings › oleObject1.bin › Root Entry › CONTENTS
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account