Malicious
MS Office Document
MD5: 577e05630d004293f6bbf580f5d880fb
Size: 61.44 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
61.44 KB · 61,440 B
First seen
2026-08-21 19:30 · 2 months ago
Last seen
2026-08-21 19:30 · 2 months ago
Last analysis
2026-09-01 20:55 · one month ago
Hashes
MD5
577e05630d004293f6bbf580f5d880fb
Sha1
8ccd7137306a760aa5f2b886c34e52fda6e96334
Sha256
0bb0df4532ac09f270020c14b6aa3c430af126d4e017f76119e180f06e80ab42
Sha384
eb8b02fa9670c2324f01810036c2ac4ca94b1f8020c6d7bbeb22027b10be855bd00b17f083e291b2179d3c75d3f0ffe6
Sha512
f2f03b7afb9cd0702ce039fd02b20063d799baf9a921e588d79d72326eb2e032da9ea8d648fb19e1c4a8ec6783018c1076698f983762eab383bc980bcdc90559
SSDeep
768:jEHlqswYrGY2tTQW4vCviWVivXFE0r2NHb94BEcQiw6qmCxPcAW5:2lkYrnRVWVdQqm
TLSH
D8534B167B023331CA41E235815FE6C897295E5F06E3A9637029F74C0F7B96F93A24DA
4 malicious · 33 files
OFF577e05630d004293f6bbf580f5d880fbT1105 · T1059.001
PS1DropperFileT1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1059.001
BINRoot Entry
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 3
STICH kept: 2secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1059.001~T1105
Shape
ole:doc>scr:ps1
malicious
2 nodes
Path
ole:doc>scr:ps1
Shape
ole:doc>scr:ps1
2 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential