Malicious
6b8e049bf1c03e57e8dcb3817fc3eb5d
MS Word Document
MD5: 6b8e049bf1c03e57e8dcb3817fc3eb5d
Size: 55.29 KB
application/msword
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 6b8e049bf1c03e57e8dcb3817fc3eb5d |
| Sha1 | 7cd5251d59d50dd5e35e9d5019446bff2b6d9712 |
| Sha256 | 2b86f53965e6bf5ae33658293d3977894c8f31d7a86df9c24a677e020af0a3a3 |
| Sha384 | 8a5e8032e03dacfb5e00dead39d13bbd68a78a92bd7e965f0f7c985e7f6b1d793a88cc6a060d48f24bb2eafd0957664f |
| Sha512 | 85d0f0a2b66aaf357d1673b86cb0e72b8143f0a51116d4ae6b3e6bcecf9378420d6b3df2ca4d40e57c20cdb825574fc5fcc24e6b03cc1e4fad4303f2c9ae5869 |
| SSDeep | 1536:Y27U+SCuwrgwSQcn4/z3/m77imLkICqqrv:YT+v17cn4C7jkIfqv |
| TLSH | D143F2BBD406B4B1F57BB5FDC90E58F4F6144A82951AF80A667FF2D146208AB03178CE |
Malicious
Malicious
Malicious
Malicious
ThisDocument
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
10 / 10
Path
oox:docm~T1027~T1059~T1059.005~T1105>oox:vba~T1027~T1059~T1059.005~T1105
Shape
oox:docm>oox:vba
malicious
2 nodes
Path
oox:docm~T1027~T1059~T1059.005~T1105>bin
Shape
oox:docm>bin
technique2 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Command (COM trace) #1
UNKNWOWNmalicious
wscriphuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #1
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
Malicious
Malicious
Malicious
ThisDocument
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Command (COM trace) #1
UNKNWOWNmalicious
wscriphuhuhuhuhuhuhuhuhuhuhu
6b8e049bf1c03e57e8dcb3817fc3eb5d › word › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA]
Dropped path (COM trace) #1
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
6b8e049bf1c03e57e8dcb3817fc3eb5d › word › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 5huhuhuhuhuhuhuhuhuhuhu
6b8e049bf1c03e57e8dcb3817fc3eb5d › word › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
6b8e049bf1c03e57e8dcb3817fc3eb5d › word › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.