Malicious
577e05630d004293f6bbf580f5d880fb
MS Office Document
MD5: 577e05630d004293f6bbf580f5d880fb
Size: 61.44 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
61.44 KB · 61,440 B
First seen
2026-08-21 19:30 · 2 months ago
Last seen
2026-08-21 19:30 · 2 months ago
Last analysis
2026-09-01 20:55 · one month ago
Hashes
MD5
577e05630d004293f6bbf580f5d880fb
Sha1
8ccd7137306a760aa5f2b886c34e52fda6e96334
Sha256
0bb0df4532ac09f270020c14b6aa3c430af126d4e017f76119e180f06e80ab42
Sha384
eb8b02fa9670c2324f01810036c2ac4ca94b1f8020c6d7bbeb22027b10be855bd00b17f083e291b2179d3c75d3f0ffe6
Sha512
f2f03b7afb9cd0702ce039fd02b20063d799baf9a921e588d79d72326eb2e032da9ea8d648fb19e1c4a8ec6783018c1076698f983762eab383bc980bcdc90559
SSDeep
768:jEHlqswYrGY2tTQW4vCviWVivXFE0r2NHb94BEcQiw6qmCxPcAW5:2lkYrnRVWVdQqm
TLSH
D8534B167B023331CA41E235815FE6C897295E5F06E3A9637029F74C0F7B96F93A24DA
4 malicious · 33 files
OFF577e05630d004293f6bbf580f5d880fbT1105 · T1059.001
PS1DropperFileT1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1059.001
BINRoot Entry
BIN䡀䌏䈯
BIN䡀䈖䌧䠤
BIN䡀䌍䏤䊲
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䒌䗱䒵䠯
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
BIN䋳䑤䒷䞰䄦䠥
BIN䡀䆊䌷䑲䈝䗻
BIN䡀䈝䗻䗜䏼䠨
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
PS1䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䙎䑨㶷䓤䌳䊱
BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 3
STICH kept: 2secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1059.001~T1105
Shape
ole:doc>scr:ps1
malicious
2 nodes
Path
ole:doc>scr:ps1
Shape
ole:doc>scr:ps1
2 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential4 malicious · 33 files
OFF577e05630d004293f6bbf580f5d880fbT1105 · T1059.001
PS1DropperFileT1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1059.001
BINRoot Entry
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
577e05630d004293f6bbf580f5d880fb › DropperFile
URL in PowerShell #2
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
577e05630d004293f6bbf580f5d880fb › DropperFile
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account