5ea3cd20f810d51e7786b0a5139e256c

MS Office Document

MD5: 5ea3cd20f810d51e7786b0a5139e256c

Size: 577.02 KB

application/vnd.ms-office

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

MD5	5ea3cd20f810d51e7786b0a5139e256c
Sha1	4544d64cdb81e23444c4282ca0b3b7855839b40f
Sha256	aab76ddfeb295d1736f7a53dd8d240812c2cb28aae31676a7977eb312196a6cc
Sha384	58d5c3fc0b89c31db2576f028370c7eb5caee5e2103a0c8d7657b9febb0dda64d60df441d902f4b84adc46bc3cd585ba
Sha512	cfeb2f5bc43b06983420068fef0a994af5de541bbd5f61503d85b9367e816e6b4e71b74b6cf6a44d8315eac9f499d768775d037a42fb762954d11aa27f1ff7f9
SSDeep	12288:TucSzO8GkrAJJVt9ngQn4khOl96vklbGPd9S:CcSqXp39gChO6vybe9S
TLSH	F3C423503A84CE37D6ABABF80ED6D2C3450BBC0C5B81C90F3390770E7A79B25916A599

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

10 / 10

Path ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin

Shape ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin

malicious 6 nodes

Path ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf

Shape ole:doc>oox:xlsx>oox:media>pdf>pdf

malicious 5 nodes

Config. Field	Value
URL distante (OLE moniker) #1	HttP:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Version	1.6
CreationDate	D:20260910092803-02'00
Producer	ReportBuilder
Version	1.3
Author	dipak
CreationDate	D:20260905130956+05'30'
Creator	PScript5.dll Version 5.2.2
ModifiedDate	D:20260905130956+05'30'
Title	Crystal Reports ActiveX Designer - PI_BILLC1.RPT
Producer	GPL Ghostscript 9.06
/Producer	GPL Ghostscript 9.06
/CreationDate	D:20260905130956+05'30'
/ModDate	D:20260905130956+05'30'
/Title	Crystal Reports ActiveX Designer - PI_BILLC1.RPT
/Creator	PScript5.dll Version 5.2.2
/Author	dipak
Version	1.3
Author	dipak
CreationDate	D:20260905130956+05'30'
Creator	PScript5.dll Version 5.2.2
ModifiedDate	D:20260905130956+05'30'
Title	Crystal Reports ActiveX Designer - PI_BILLC1.RPT
Producer	GPL Ghostscript 9.06
/Producer	GPL Ghostscript 9.06
/CreationDate	D:20260905130956+05'30'
/ModDate	D:20260905130956+05'30'
/Title	Crystal Reports ActiveX Designer - PI_BILLC1.RPT
/Creator	PScript5.dll Version 5.2.2
/Author	dipak

Config. Field	Value
URL distante (OLE moniker) #1	HttP:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

You must be signed in to view YARA rules.