Suspect
4eb98e169da96cbc1ee64b0b7ae211a5
MS Office Document
MD5: 4eb98e169da96cbc1ee64b0b7ae211a5
Size: 752.13 KB
application/vnd.ms-office
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 4eb98e169da96cbc1ee64b0b7ae211a5 |
| Sha1 | 92bb8235e2bfa4bf755325edfddc48ae422dc0c8 |
| Sha256 | c5fa4668a918ce5753b54b5cf89160a0fd03ece2bab29029789a9b565348cb2d |
| Sha384 | e243449c9574d57efbcee06ce7e8f829b7f5ac139c71714ee706cddf5f8892b9487063e32cbc60d6a5755493061030d4 |
| Sha512 | 6b810b826add02aa3846e7064c84424d646ba95e540ff9b4b856fac2d9d3794a55187cf5c31ba292e5b8ea25f9e80f4bc3450cb0ab167c08222bf0164e48d30d |
| SSDeep | 12288:gvAjvB/h65J3WyLl6rk5jyb8iX5eRsWAD7Z6CS67B/QG5y2PkTPa8dWoXYWZxWiy:BjvBo5JGyRiwjy9xv8fuH5y2ICiWoXYf |
| TLSH | F8F42325F7C2D514C307C4B849C2DC16826D7C65BE26EA1F3685F70D91B17EA83EA26C |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 10
STICH kept: 1secondary ignored: 9
bin
4img
1oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>oox:xlsx>oox:media>ole:doc
Shape
ole:doc>oox:xlsx>oox:media>ole:doc
4 nodes
| Name | Value |
|---|---|
| Version | 1.7 |
| Author | Labotronics Scientific |
| CreationDate | D:20260731103220+05'30' |
| Creator | Labotronics Scientific |
| Keywords | Quotation | Labotronics Scientific |
| ModifiedDate | D:20260731103220+05'30' |
| Subject | Quotation |
| Title | LABOT20260731102706 |
| Producer | TCPDF 6.6.5 (http://www.tcpdf.org) |
| /Title | LABOT20260731102706 |
| /Author | Labotronics Scientific |
| /Subject | Quotation |
| /Keywords | Quotation | Labotronics Scientific |
| /Creator | Labotronics Scientific |
| /Producer | TCPDF 6.6.5 (http://www.tcpdf.org) |
| /CreationDate | D:20260731103220+05'30' |
| /ModDate | D:20260731103220+05'30' |
URI
URI
http:/huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
No malware configuration was found at this point.
URI
URI
http:/huhuhuhuhuhuhu
4eb98e169da96cbc1ee64b0b7ae211a5 › Root Entry › MBD0041E154 › Package › xl › embeddings › oleObject1.bin › Root Entry › CONTENTS
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.