Malicious
ZIP Archive
MD5:
Size: 0 B
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
13 malicious · 84 files
ZIPead5ea52f1c57c7371351896c4e6df6d9643cc1f6112d8dca6b428e19ef77089.zipT1221Exploit
OFFead5ea52f1c57c7371351896c4e6df6d9643cc1f6112d8dca6b428e19ef77089.xlsxT1221Exploit
OFF[Repaired @0x00002400]
BIN.
BINRoot Entry
BINCompObj
BINWorkbook
BINMBD00048C39
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
BINdrawings
BINmedia
BINworksheets
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
BINembeddings
OFFoleObject2.binT1221
BIN.
BINRoot Entry
OFFOle10Native
XLS[Repaired @0x00000105]
XLS[Repaired @0x00000905]T1221
XML[Content_Types].xml
BIN_rels
BINxl
XMLworkbook.xml
BIN_rels
BINworksheets
XMLsheet1.xml
XMLsheet2.xml
XMLsheet3.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
OFFsheet3.xml.relsT1221
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
BINmedia
BINprinterSettings
XMLcalcChain.xml
BINdocProps
OFFoleObject1.bin
OFFMicrosoft_Office_Excel_97-2003_Worksheet1.xls
BIN.
BIN[Formulas]
BINexternalLinks
BIN_rels
OFFexternalLink1.xml.relsT1221
XMLexternalLink1.xml
BINprinterSettings
BINdocProps
BINCompObj
BINMBD00048C3A
BINOleExploit
BINSummaryInformation
BINDocumentSummaryInformation
| Config. Field | Value |
|---|---|
| Target | http:/huhuhuhuhuhuhu |
| Path | sheethuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious Document RelationShip
URImalicious
http:/huhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential