Malicious
631ca61a65af9a778a494d171631a920
MS Office Document
MD5: 631ca61a65af9a778a494d171631a920
Size: 786.94 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 631ca61a65af9a778a494d171631a920 |
| Sha1 | 0a07f0698b906cfdec5c3fc2986c720766b99923 |
| Sha256 | 75c990a5d56ae00326060d1b6c7148a062537d8ae26926513dea888631596fda |
| Sha384 | 46adaaaa24b405accc45ec71b2a0684049ac534cf6c6d90395bcc38516e45308150a091b43c42ce4e9fbef24ed38bc1c |
| Sha512 | 3afd873542beab52eefc25f3846b5bd117b32231d44e896d54de062a290beee0209ff953b3baf3082978a8cf43d4111e9127b029045de127ab3bc48b7315eac9 |
| SSDeep | 24576:Y6S0UOLFsp/e20nfc3lUBtdlOOsSOlibaUcZ:Y6pUX/e2yU3lOlO57l0rc |
| TLSH | F1F423223C52CF53D2A6A2B318DC9CC71B9BFC01AB5158EB29D4379D09315B0CFA25AD |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
9 / 9
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>bin
Shape
ole:doc>oox:xlsx>oox:media>bin
malicious
4 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.4 |
| CreationDate | D:20260812131346Z |
| ModifiedDate | D:20260812131346Z |
| Producer | iText 2.1.7 by 1T3XT |
| /ModDate | D:20260812131346Z |
| /CreationDate | D:20260812131346Z |
| /Producer | iText 2.1.7 by 1T3XT |
| Version | 1.7 |
| Author | Thabo Katane |
| CreationDate | D:20240209092531+02'00' |
| Creator | Microsoft® Word for Microsoft 365 |
| ModifiedDate | D:20240209092531+02'00' |
| Producer | Microsoft® Word for Microsoft 365 |
| /Author | Thabo Katane |
| /Creator | Microsoft® Word for Microsoft 365 |
| /CreationDate | D:20240209092531+02'00' |
| /ModDate | D:20240209092531+02'00' |
| /Producer | Microsoft® Word for Microsoft 365 |
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
631ca61a65af9a778a494d171631a920 › Root Entry › MBD0000AB32 › Package › xl › embeddings › oleObject2.bin › Root Entry › CONTENTS
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.