Malicious
Malicious

6e66acbc3c8abffc1d262763c4a928bc

MS Office Document
MD5: 6e66acbc3c8abffc1d262763c4a928bc
Size: 4.48 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

This sample is a 4.3 MB MS Office Document classified as malicious by Malva.RE. Static analysis extracted 34 embedded or derived files. It matches 14 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
232a1639b1d70e7f4721b2811cb5dab3e096393d00a43bc46ba91cdcc36d9d84
MD5
6e66acbc3c8abffc1d262763c4a928bc
Verdict
Malicious
File type
MS Office Document · 4.3 MB
MITRE ATT&CK
T1027T1059.001

Cite this report: https://app.malva.re/sha256/232a1639b1d70e7f4721b2811cb5dab3e096393d00a43bc46ba91cdcc36d9d84

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
4.48 MB · 4,483,072 B
First seen
2026-11-01 17:00 · 2 days ago
Last seen
2026-11-01 17:00 · 2 days ago
Last analysis
2026-11-01 17:00 · 2 days ago
Hashes
MD5 6e66acbc3c8abffc1d262763c4a928bc Sha1 a210334e66f66a5df7521286582f6d4601ef1b6e Sha256 232a1639b1d70e7f4721b2811cb5dab3e096393d00a43bc46ba91cdcc36d9d84 Sha384 408c6e5caf3b3d04dc0b1e8a26c88c997d5c0033052f93af12a034db8dd40f3c62a83d333c565b5ea3a8530c6c699265 Sha512 10b49867131f6a0f432a53536189c231b4767bc0b06fdffa44d0bf088604c121cb757eb43f7240a4868e453bc538796d5cee6938414a41f33c4e2526f6fd8ca0 SSDeep 49152:F6Zw86JwX9Pi+O8AWtlZi04GAkuxA6sVg255DEV1/fG2GJUUy:F6e9JMqv853Zi04GzuZsv54VNftMy TLSH B7265CBA3F81C294ECA52E1B0812CADF03297C29EDCE437265F9745E15D5D9E0368DAC

12 malicious · 35 files
OFF6e66acbc3c8abffc1d262763c4a928bc
BINRoot Entry
BIN䄦㡥䆾䅤
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
PS1䡀㼿䕷䑬㭪䗤䠤
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䌋䄱䜵㸾䖴㢊䀡䠈
PS1䌋䄱䜵䓾䙨㰳䕹䔊
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1䌋䄱䜵䀾䎲㢍㥖㳖㠩
PS1[Deobfuscated PS]
BIN[Base64-Block]
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>scr:ps1~T1027~T1059.001
Shape ole:doc>scr:ps1
malicious 2 nodes

Deobfuscated PowerShell UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$env:Yhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

12 malicious · 35 files
OFF6e66acbc3c8abffc1d262763c4a928bc
BINRoot Entry
BIN䄦㡥䆾䅤
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
PS1䡀㼿䕷䑬㭪䗤䠤
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䌋䄱䜵㸾䖴㢊䀡䠈
PS1䌋䄱䜵䓾䙨㰳䕹䔊
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1䌋䄱䜵䀾䎲㢍㥖㳖㠩
PS1[Deobfuscated PS]
BIN[Base64-Block]
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
No malware configuration was found at this point.

Deobfuscated PowerShell UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
6e66acbc3c8abffc1d262763c4a928bc › Root Entry › 䡀㼿䕷䑬㭪䗤䠤 › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
$env:Yhuhuhuhuhuhuhuhuhuhuhu
6e66acbc3c8abffc1d262763c4a928bc › Root Entry › 䡀㼿䕷䑬㭪䗤䠤 › [Deobfuscated PS] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙