Malicious
544c105a4d344662a8c545b424c53b7c
MS Office Document
MD5: 544c105a4d344662a8c545b424c53b7c
Size: 2.27 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
2.27 MB · 2,270,720 B
First seen
2026-10-19 23:45 · 6 days ago
Last seen
2026-10-19 23:45 · 6 days ago
Last analysis
2026-10-19 23:45 · 6 days ago
Hashes
MD5
544c105a4d344662a8c545b424c53b7c
Sha1
6b70aefb3a65b1224c1444d51b48926313f18b4a
Sha256
e6caf0587fc3b94b176f274ff0d420e0a7447ca57fdb61f3815f63dec416148d
Sha384
05ca451c397c02d733b2874ce932dc21fb704653bdef982fa51d6952a2171555819e23183c0ac8a1e7c85e2dde44b9bc
Sha512
7889319bfada81abe8f773c4c944470e6d85d3dbfc4b1e6e26e1b3c23d6bab573e3e8c28b0d5f4f2ef7aff14c3cbdd4dbd39ab96382126022deea614a787a521
SSDeep
24576:lfxK1PcpukylEL3CJEdBPHjzWO1UauftimpvpYe0DZp52lHF6Y5mJYAppfSKMxAV:lQSdDSidBLZUamiuX0Df52lMUllWf
TLSH
85B54C636A50600642B5A8FABEBD5E37785F340D101AD98EFFD31B86E51E6F44802E1F
14 malicious · 34 files
OFF544c105a4d344662a8c545b424c53b7cT1027 · T1059.001
BINRoot Entry
BIN䄦㡥䆾䅤
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
PS1䡀㼿䕷䑬㭪䗤䠤T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Base64-Block]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䌋䄱䜵䒾㵚䕘䍒䜡䠑
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
PS1䌋䄱䜵㫾㣡㹕㦱䂛䏶䠬T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 2
STICH kept: 1secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:ps1
malicious
2 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential14 malicious · 34 files
OFF544c105a4d344662a8c545b424c53b7cT1027 · T1059.001
BINRoot Entry
BIN䄦㡥䆾䅤
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
PS1䡀㼿䕷䑬㭪䗤䠤T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Base64-Block]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䌋䄱䜵䒾㵚䕘䍒䜡䠑
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
PS1䌋䄱䜵㫾㣡㹕㦱䂛䏶䠬T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
544c105a4d344662a8c545b424c53b7c › Root Entry › 䡀㼿䕷䑬㭪䗤䠤 › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
544c105a4d344662a8c545b424c53b7c › Root Entry › 䡀㼿䕷䑬㭪䗤䠤 › [Deobfuscated PS] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account