Malicious
MS Office Document
MD5:
Size: 0 B
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
36 malicious · 696 files
OFF64bda120cb447e0c03f451190022a57bT1059.005
BINRoot Entry
BIN䡀䆒䑲
BIN䡀䌏䈯
BIN䡀㲞䈝䗻
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀䌍䏤䊲
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䋜䕲䆷䗸
BIN䡀䒌䗱䒵䠯
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䈝䗻䗜䏼䠨
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䄛䌧㫲䗸䒷䠱
BIN䡀䒌䗱䒵㮯䈹䗱
BIN䡀䕌䄨䈷䒏䇯䕨
BIN䡀䖖㪬䖶䐨䏥䠼
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䙎䑨㶷䓤䌳䊱
BIN䌋䄱䜵㾾㯳䇯㫵䑷
BIN䌋䄱䜵㿾㭜㮗㬝㰏
EXE䌋䄱䜵㶾㿜㭋㬙㭊㵕
BIN䌋䄱䜵㷾䚨䏏䕧䗋䠱
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䒌䗱䒵㬯䑲䌧䌷䑲
BIN䡀䖖㪬䖶䐨䏥㷼䐤䠨
VBS䌋䄱䜵㶾㼼䕦䓬䞷䅹䠶T1059.005
PS1[PowerShell Command]T1059.005
BIN[PowerShell Command].deobfuscated.vbs
SH[Command #0]
PS1[Deobfuscated PS]T1059.005
PS1[PowerShell Command]T1059.005
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN䌋䄱䜵㶾㼼䕦䓬䞷䅹䠶.deobfuscated.vbs
SH[Command #0]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䌋䄱䜵㭾䉨䄋䑱䕨䌋䐷䓤
BIN䡀㿿䇶䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
VBS䌋䄱䜵㼾䗨䈗䗻䌍䏤䊲䙾䖥
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
VBS䌋䄱䜵㼾䗨䌙㻳䊨䖬䕷㿼䏤䈸䙾䖥
BIN䆒䑲䟾㥈㯃㧆㥍㤅㠏㤅㩄㣄㮀㮇䈾䈻
BINDigitalSignature
BIN㭿㦊㬁㯊㨍㧃㣄㦌㨊㬈㥀㫄㢋㩂㪎㪆䠌
BINSummaryInformation
BINMsiDigitalSignatureEx
BIN_044B82E6289DC5A2E35D8BA1B9F4210E
BIN_05D5AA7E4350E1771088ABE5F0EC4DAC
BIN_1354D0E01EAE18DFE051CB0A6152BE04
BIN_184DAAB7EC3C4E87A4D096A81483192A
BIN_1D121053C0CE46619C570BAEEDE16BB7
BIN_241F8550D7313F5D730D44098604B6A7
BIN_3EE9D044C075425C81DD7E5BDED97740
BIN_44822355868347C6B0AB7335858B9B1B
BIN_4ECC8554055CA579195AC72D6E4A4A6E
BIN_755F63359A7FED3673062D4BE4EEEB1F
BIN_7700C3DD020B3E866398FFC19B74DC85
BIN_81D57EF6096CA277B68DFD7853430352
BIN_8481DC9D8740A372971A875A6D7F1FB3
BIN_88AB4E9C9EAA8AB48E134688D2A5F218
BIN_916A3D9E2BA6AA273F6979BC42A0B100
BIN_9FA9C0CF533298FB916F01E8C1728E87
BIN_A321378C0723A249C79DAD49CF2290A1
BIN_AE4B52809020252C5AA0CF8FF393625D
BIN_AF2F573613A29B08EAF8D1BBE1ACCD53
BIN_B1BD15A321D1FE08B7E48632FE5F8187
BIN_B694B19E91F1480AA61E7D92A0AE2E58
BIN_B87382FCA5C153702794B52A6D35450F
BIN_C41A35C6A37CD084859E3CB2E70AE9DA
BIN_D0CDE47E90F54893845E85E70312E181
BIN_D71D65078B87897EC309110E3C193843
BIN_D993EAC9652D6B277EC1D3AD9386A898
BIN_DBB36C507EA404A8B6D41FAD5562907B
BIN_E107A392B92B481CA766BF48D2548406
BIN_EC8BD2B2343E8DC25C77455CCFAFE1DF
BIN_F14A379D2D214949AE2A09418C1C5012
BIN_F5E8C90CE968B3FD3385208B479FE43C
BIN_FD9BA260F6E682E262FA42F3C05C6925
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| _F14A379D2D214949AE2A09418C1C5012 | 1.7 |
| _F14A379D2D214949AE2A09418C1C5012 | Rob de Veij |
| _F14A379D2D214949AE2A09418C1C5012 | D:20240930143555+01'00' |
| _F14A379D2D214949AE2A09418C1C5012 | Microsoft® Word for Microsoft 365 |
| _F14A379D2D214949AE2A09418C1C5012 | D:20240930143555+01'00' |
| _F14A379D2D214949AE2A09418C1C5012 | RVTools 4.7.1 October 3, 2024 |
| _F14A379D2D214949AE2A09418C1C5012 | Microsoft® Word for Microsoft 365 |
| _F14A379D2D214949AE2A09418C1C5012 | true |
| _F14A379D2D214949AE2A09418C1C5012 | 2023-10-13T16:49:30Z |
| _F14A379D2D214949AE2A09418C1C5012 | Privileged |
| _F14A379D2D214949AE2A09418C1C5012 | Public No Visual Label |
| _F14A379D2D214949AE2A09418C1C5012 | 945c199a-83a2-4e80-9f8c-5a91be5752dd |
| _F14A379D2D214949AE2A09418C1C5012 | 99a04929-6196-4e8e-ba9f-4d322af4fd51 |
| _F14A379D2D214949AE2A09418C1C5012 | 0 |
| _F14A379D2D214949AE2A09418C1C5012 | RVTools 4.7.1 October 3, 2024 |
| _F14A379D2D214949AE2A09418C1C5012 | Rob de Veij |
| _F14A379D2D214949AE2A09418C1C5012 | Microsoft® Word for Microsoft 365 |
| _F14A379D2D214949AE2A09418C1C5012 | D:20240930143555+01'00' |
| _F14A379D2D214949AE2A09418C1C5012 | D:20240930143555+01'00' |
| _F14A379D2D214949AE2A09418C1C5012 | Microsoft® Word for Microsoft 365 |
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #7
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #9
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #10
URIsuspect
https:huhuhuhuhuhuhu
URLs in VB Code - #11
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #12
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #13
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #14
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #15
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #16
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #17
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #18
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #19
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #20
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #21
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #22
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
pscommhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
" &
phuhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
pshuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
with huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
with huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
bypasshuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
bypasshuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential