Malicious MS Office Document analysis – 6676ab2dbd35

The file 6676ab2dbd358aa22edde87bfc905e15 is a MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 203 embedded or derived files. It matches 15 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: —
MD5: -
Verdict: Malicious
File type: MS Office Document

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

3 malicious · 204 files

OFF6676ab2dbd358aa22edde87bfc905e15

BINRoot Entry

IMG0x000241D8.svg

IMG0x000BB1A8.svg

EXEFirefoxInstaller.exe

EXEScreenRec_webinstall_all.exe

BATlola.bat

VBSrunTaskAsAdmin.vbs

VBSsecondaryTask.vbs

VBStask.vbs

EXEopenvpninstall2.3.2x64.exe

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #4 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #5 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #6 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #7 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #8 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #9 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #10 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #11 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #12 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #13 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #14 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #15 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #16 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #17 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #18 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #19 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #20 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #21 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #22 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #23 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

Overview

Summary by MalvaGPT

Characteristics

File Structure

Artefacts24

File Structure

Artefacts24