Malicious MS Office Document analysis – 688927f02f53

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

3 malicious · 112 files

OFF688927f02f5331c128059ef137ae588c

BINRoot Entry

BIN䡀㲞䈝䗻

BIN䡀䌋䄱䜵

BIN䡀䌍䏤䊲

BIN䡀䕎䒵䠵

BIN䌋䄱䜵㷾䚨

BIN䌋䄱䜵㾾䠳

BIN䡀㬿䏲䐸䖱

BIN䡀㽿䅤䈯䠶

BIN䡀䈏䗤䕸䠨

BIN䡀䈛䌪䗶䜵

BIN䡀䋌䆨㫮䛲

BIN䡀䒌䗱䒵䠯

BIN䡀䓞䕪䇤䠨

BIN䡀䕙䓲䕨䜷

BIN䌋䄱䜵䌾䉱䠲

BIN䡀䆊䌷䑲䈝䗻

BIN䡀䈝䗻䗜䏼䠨

BIN䡀䌍䈵䗦䕲䠼

BIN䡀䌜䑪䗤䕸䠨

BIN䡀䒌䓰䑲䑨䠷

BIN䡀䓊㼳䄨䆵䠫

BIN䡀䕍䒕䄦䒷䠵

IMG䌋䄱䜵䅾䑤䈱䠵

IMG䌋䄱䜵䇾䄬䒯䠪

BIN䌋䄱䜵䗾䅤䄥䎦

PS1䡀㼿䕷䑬㭪䗤䠤

PS1[Deobfuscated PS]

BIN䡀㼿䕷䑬㹪䒲䠯

BIN䡀㿿䏤䇬䗤䒬䠱

BIN䡀䄛䌧㫲䗸䒷䠱

BIN䡀䒌䗱䒵㮯䈹䗱

BIN䡀䕌䄨䈷䒏䇯䕨

BIN䡀䘌䗶䐲䆊䌷䑲

BIN䡀䙎䑨㶷䓤䌳䊱

BIN䌋䄱䜵䆾䐲䏳䗨䠬

BIN䌋䄱䜵䆾䖸䌷䒦䠱

BIN䌋䄱䜵䈾䆻䄯䌰䠦

BIN䌋䄱䜵䌾䖱䌷䒦䠱

BIN䌋䄱䜵䕾䐨䙲䆬䠲

BIN䌋䄱䜵䕾䓨䌤䌵䠦

BIN䡀㲊㪿䓳䈜䕤䋦䛎

EXE䌋䄱䜵㹾䈵䈵䞴䏧䠯

IMG䌋䄱䜵䅾䑤䈱㡵䓾䊱

EXE䌋䄱䜵䙾䈬䈺䞵䛨䠨

BIN䡀㲊㹿䈵䈛䘴䖬䗬䠨

BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱

BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨

BIN䡀䒌䗱䒵㬯䑲䌧䌷䑲

EXE䌋䄱䜵䄾䆬䖸䄷䗦䇾䏯

BIN䌋䄱䜵䆾䇰䌯䎱䕤䒵䠺

BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶

BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨

BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦

BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨

BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦

BIN䡀䒋䗲䗶䄵䓳䕨㲞䈜䘴䑨䈦

EXE䌋䄱䜵䄾䓬䆤䄮䈪䋦䌤䈱䞵䛨䠨

BINDigitalSignature

EXE䌋䄱䜵㹾䚲䕨䋜䏨㼯䕦䓬㵷䘤䆱䈫䞵䏧䠯

BINSummaryInformation

BINMsiDigitalSignatureEx

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #4 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #5 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #6 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #7 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #8 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #9 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #10 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #11 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #12 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #13 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #14 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #15 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #16 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #17 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #18 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #19 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #20 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #21 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #22 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #23 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #24 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #25 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #26 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #27 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #28 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #29 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential