Malicious
MS Office Document
MD5: 5ea3cd20f810d51e7786b0a5139e256c
Size: 577.02 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 5ea3cd20f810d51e7786b0a5139e256c |
| Sha1 | 4544d64cdb81e23444c4282ca0b3b7855839b40f |
| Sha256 | aab76ddfeb295d1736f7a53dd8d240812c2cb28aae31676a7977eb312196a6cc |
| Sha384 | 58d5c3fc0b89c31db2576f028370c7eb5caee5e2103a0c8d7657b9febb0dda64d60df441d902f4b84adc46bc3cd585ba |
| Sha512 | cfeb2f5bc43b06983420068fef0a994af5de541bbd5f61503d85b9367e816e6b4e71b74b6cf6a44d8315eac9f499d768775d037a42fb762954d11aa27f1ff7f9 |
| SSDeep | 12288:TucSzO8GkrAJJVt9ngQn4khOl96vklbGPd9S:CcSqXp39gChO6vybe9S |
| TLSH | F3C423503A84CE37D6ABABF80ED6D2C3450BBC0C5B81C90F3390770E7A79B25916A599 |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
10 / 10
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf
malicious
5 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | HttP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.6 |
| CreationDate | D:20260910092803-02'00 |
| Producer | ReportBuilder |
| Version | 1.3 |
| Author | dipak |
| CreationDate | D:20260905130956+05'30' |
| Creator | PScript5.dll Version 5.2.2 |
| ModifiedDate | D:20260905130956+05'30' |
| Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| Producer | GPL Ghostscript 9.06 |
| /Producer | GPL Ghostscript 9.06 |
| /CreationDate | D:20260905130956+05'30' |
| /ModDate | D:20260905130956+05'30' |
| /Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| /Creator | PScript5.dll Version 5.2.2 |
| /Author | dipak |
| Version | 1.3 |
| Author | dipak |
| CreationDate | D:20260905130956+05'30' |
| Creator | PScript5.dll Version 5.2.2 |
| ModifiedDate | D:20260905130956+05'30' |
| Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| Producer | GPL Ghostscript 9.06 |
| /Producer | GPL Ghostscript 9.06 |
| /CreationDate | D:20260905130956+05'30' |
| /ModDate | D:20260905130956+05'30' |
| /Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| /Creator | PScript5.dll Version 5.2.2 |
| /Author | dipak |