Suspect
MS Word Document
MD5: 5bfbfe8380fed6b81af7e1a2c51d5fb4
Size: 320.49 KB
application/msword
General
Structural Analysis
Config.1
Yara Rules11
Sync
Community
Summary by MalvaGPT
Characteristics
|
Hash | Hash Value |
|---|---|
| MD5 | 5bfbfe8380fed6b81af7e1a2c51d5fb4
|
| Sha1 | 07399729d3533a76936c6101918797765f9716ef
|
| Sha256 | 51aaa8846bd3bcb529cfc6f868add40c19839d692d9ed218c97fb58be39fcc7b
|
| Sha384 | 48d37c99e945bf3a76ee5fd7e2f4522424524ee60210faaaac1c323579ef9db0e18ae108e002f281a4eca62ef11a42a3
|
| Sha512 | 2e0888d9e9845301b866d5200475bb87b5f108975cfc4a83775f9ef4082b12a91bf01677e1b17015becd4a0f52b7a09dde24912dcd1d5232ae23925f7e46c474
|
| SSDeep | 6144:zJf9KPuThcPhAeXsiz6Q6lFmlLU8WhM2LWq4YHP8QNB/1wMs/x5hLJziD:P2tsiilF4LUTJLFHUa/+MspfgD
|
| TLSH | 6E6423680BCB6247D3D382FC866C9961BBFA3703505B2275F7B4C24DDE5836A1237649
|
File Structure
5bfbfe8380fed6b81af7e1a2c51d5fb4
[Content_Types].xml
_rels
.rels
word
document.xml
footnotes.xml
footer3.xml
footer2.xml
header3.xml
endnotes.xml
embeddings
oleObject1.bin
Root Entry
Ole
CompObj
ObjInfo
CONTENTS
Text (Preview)
Page #1
#Stream {7}
#Stream {144}
#Stream {145}
#Stream {146}
#Stream {147}
#Stream {148}
#Stream {149}
#Stream {150}
#Stream {152}
#Stream {153}
#Stream {156}
#Stream {157}
#Stream {158}
#Stream {159}
#Stream {160}
#Stream {161}
#Stream {162}
#Stream {154}
#Stream {142}
#Stream {163}
#Stream {164}
#Stream {165}
#Stream {166}
#Stream {155}
#Stream {143}
#Stream {167}
#Stream {169}
#Stream {170}
#Stream {171}
#Stream {172}
#Stream {173}
#Stream {174}
#Stream {175}
#Stream {177}
#Stream {178}
Structure
media
image1.emf
theme
theme1.xml
settings.xml
webSettings.xml
fontTable.xml
styles.xml
Malware Configuration - URLs in PDF
|
Config. Field0 | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu
|
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu
|
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Informations
|
Name | Value |
|---|---|
| CONTENTS | 1.6 |
| CONTENTS | Thomas Schneider |
| CONTENTS | D:20251013150711+02'00' |
| CONTENTS | Acrobat PDFMaker 25 für Word |
| CONTENTS | |
| CONTENTS | D:20251013150730+02'00' |
| CONTENTS | |
| CONTENTS | |
| CONTENTS | Adobe PDF Library 25.1.20 |
| CONTENTS | Thomas Schneider |
| CONTENTS | |
| CONTENTS | |
| CONTENTS | D:20251013150711+02'00' |
| CONTENTS | Acrobat PDFMaker 25 für Word |
| CONTENTS | |
| CONTENTS | D:20251013150730+02'00' |
| CONTENTS | Adobe PDF Library 25.1.20 |
| CONTENTS | D:20251013130538 |
| CONTENTS | |
| CONTENTS | |
Artefacts
|
Name | Value |
|---|---|
| URI | https:huhuhuhuhuhuhuhuhuhuhu
|
| URI | https:huhuhuhuhuhuhuhuhuhuhu
|
| URI | mailtohuhuhuhuhuhuhuhuhuhuhu
|
| URI | https:huhuhuhuhuhuhuhuhuhuhu
|
| URI | https:huhuhuhuhuhuhuhuhuhuhu
|
Full artefact values (URLs, paths, registry keys…) are available with Essential.
Unlock with Essential
5bfbfe8380fed6b81af7e1a2c51d5fb4 (320.49 KB)
File Structure
5bfbfe8380fed6b81af7e1a2c51d5fb4
[Content_Types].xml
_rels
.rels
word
document.xml
footnotes.xml
footer3.xml
footer2.xml
header3.xml
endnotes.xml
embeddings
oleObject1.bin
Root Entry
Ole
CompObj
ObjInfo
CONTENTS
Text (Preview)
Page #1
#Stream {7}
#Stream {144}
#Stream {145}
#Stream {146}
#Stream {147}
#Stream {148}
#Stream {149}
#Stream {150}
#Stream {152}
#Stream {153}
#Stream {156}
#Stream {157}
#Stream {158}
#Stream {159}
#Stream {160}
#Stream {161}
#Stream {162}
#Stream {154}
#Stream {142}
#Stream {163}
#Stream {164}
#Stream {165}
#Stream {166}
#Stream {155}
#Stream {143}
#Stream {167}
#Stream {169}
#Stream {170}
#Stream {171}
#Stream {172}
#Stream {173}
#Stream {174}
#Stream {175}
#Stream {177}
#Stream {178}
Structure
media
image1.emf
theme
theme1.xml
settings.xml
webSettings.xml
fontTable.xml
styles.xml
Characteristics
Malware Configuration - URLs in PDF
|
Config. Field0 | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu
|
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu
|
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Artefacts
|
Name | Value | Location |
|---|---|---|
| URI | https:huhuhuhuhuhuhuhuhuhuhu
|
5bfbfe8380fed6b81af7e1a2c51d5fb4 > word > embeddings > oleObject1.bin > Root Entry > CONTENTS |
| URI | https:huhuhuhuhuhuhuhuhuhuhu
|
5bfbfe8380fed6b81af7e1a2c51d5fb4 > word > embeddings > oleObject1.bin > Root Entry > CONTENTS |
| URI | mailtohuhuhuhuhuhuhuhuhuhuhu
|
5bfbfe8380fed6b81af7e1a2c51d5fb4 > word > embeddings > oleObject1.bin > Root Entry > CONTENTS |
| URI | https:huhuhuhuhuhuhuhuhuhuhu
|
5bfbfe8380fed6b81af7e1a2c51d5fb4 > word > embeddings > oleObject1.bin > Root Entry > CONTENTS |
| URI | https:huhuhuhuhuhuhuhuhuhuhu
|
5bfbfe8380fed6b81af7e1a2c51d5fb4 > word > embeddings > oleObject1.bin > Root Entry > CONTENTS |
Full artefact values (URLs, paths, registry keys…) are available with Essential.
Unlock with Essential
You must be signed in to post a comment.
You need a premium account to access this feature.
You must be signed in to post a comment.