Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
FileType
Microsoft Office Document
12 malicious · 44 files
OFF5c057af2f358fc10107d5ccdb39938adMS Office Document
BIN䡀䌏䈯extracted from MS Office Document
BIN䄧䄷䆾䅤extracted from MS Office Document
BINPumpFileextracted from Unknown
VBSVbsFileextracted from Unknown · VBScript
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
BINVbsFile.deobfuscated.vbs
SH[Command #0] code extracted · Bash Script
BIN䡀䈖䌧䠤extracted from MS Office Document
BIN䡀㬿䏲䐸䖱extracted from MS Office Document
BIN䡀㽿䅤䈯䠶extracted from MS Office Document
BIN䡀䈏䗤䕸䠨extracted from MS Office Document
BIN䡀䈛䌪䗶䜵extracted from MS Office Document
BIN䡀䓞䕪䇤䠨extracted from MS Office Document
BIN䡀䕙䓲䕨䜷extracted from MS Office Document
BIN䡀䈛䒰䈹䌏䈯extracted from MS Office Document
BIN䡀䌍䈵䗦䕲䠼extracted from MS Office Document
BIN䡀䒌䓰䑲䑨䠷extracted from MS Office Document
BIN䡀㼿䕷䑬㭪䗤䠤extracted from MS Office Document
BIN䡀㼿䕷䑬㹪䒲䠯extracted from MS Office Document
BIN䡀㿿䏤䇬䗤䒬䠱extracted from MS Office Document
BIN䡀䕌䄨䈷䒏䇯䕨extracted from MS Office Document
BIN䡀䖖㯬䏬㱨䖤䠫extracted from MS Office Document
BIN䡀䘌䗶䐲䆊䌷䑲extracted from MS Office Document
BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱extracted from MS Office Document
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨extracted from MS Office Document
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶extracted from MS Office Document
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨extracted from MS Office Document
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦extracted from MS Office Document
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨extracted from MS Office Document
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦extracted from MS Office Document
BINDigitalSignatureextracted from MS Office Document
BINSummaryInformationextracted from MS Office Document
BINMsiDigitalSignatureExextracted from MS Office Document
VBSErrorScriptFileextracted from MS Office Document · VBScript
BINPs1Fileextracted from MS Office Document
BINPumpFileextracted from MS Office Document
BINVbsFileextracted from MS Office Document
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"scriphuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
psscrihuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
psscrihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
12 malicious · 44 files
OFF5c057af2f358fc10107d5ccdb39938adMS Office Document
BIN䡀䌏䈯extracted from MS Office Document
BIN䄧䄷䆾䅤extracted from MS Office Document
BINPumpFileextracted from Unknown
VBSVbsFileextracted from Unknown · VBScript
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
BINVbsFile.deobfuscated.vbs
SH[Command #0] code extracted · Bash Script
BIN䡀䈖䌧䠤extracted from MS Office Document
BIN䡀㬿䏲䐸䖱extracted from MS Office Document
BIN䡀㽿䅤䈯䠶extracted from MS Office Document
BIN䡀䈏䗤䕸䠨extracted from MS Office Document
BIN䡀䈛䌪䗶䜵extracted from MS Office Document
BIN䡀䓞䕪䇤䠨extracted from MS Office Document
BIN䡀䕙䓲䕨䜷extracted from MS Office Document
BIN䡀䈛䒰䈹䌏䈯extracted from MS Office Document
BIN䡀䌍䈵䗦䕲䠼extracted from MS Office Document
BIN䡀䒌䓰䑲䑨䠷extracted from MS Office Document
BIN䡀㼿䕷䑬㭪䗤䠤extracted from MS Office Document
BIN䡀㼿䕷䑬㹪䒲䠯extracted from MS Office Document
BIN䡀㿿䏤䇬䗤䒬䠱extracted from MS Office Document
BIN䡀䕌䄨䈷䒏䇯䕨extracted from MS Office Document
BIN䡀䖖㯬䏬㱨䖤䠫extracted from MS Office Document
BIN䡀䘌䗶䐲䆊䌷䑲extracted from MS Office Document
BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱extracted from MS Office Document
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨extracted from MS Office Document
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶extracted from MS Office Document
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨extracted from MS Office Document
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦extracted from MS Office Document
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨extracted from MS Office Document
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦extracted from MS Office Document
BINDigitalSignatureextracted from MS Office Document
BINSummaryInformationextracted from MS Office Document
BINMsiDigitalSignatureExextracted from MS Office Document
VBSErrorScriptFileextracted from MS Office Document · VBScript
BINPs1Fileextracted from MS Office Document
BINPumpFileextracted from MS Office Document
BINVbsFileextracted from MS Office Document
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
5c057af2f358fc10107d5ccdb39938ad › Root Entry › 䄧䄷䆾䅤 › VbsFile › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
"scriphuhuhuhuhuhuhuhuhuhuhu
5c057af2f358fc10107d5ccdb39938ad › Root Entry › 䄧䄷䆾䅤 › VbsFile › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
psscrihuhuhuhuhuhuhuhuhuhuhu
5c057af2f358fc10107d5ccdb39938ad › Root Entry › 䄧䄷䆾䅤 › VbsFile › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
psscrihuhuhuhuhuhuhuhuhuhuhu
5c057af2f358fc10107d5ccdb39938ad › Root Entry › 䄧䄷䆾䅤 › VbsFile › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Coming soon: export of this report's indicators to MISP and EDR platforms.
