Malicious
778e19b7e204892e06ef2a03f90457df
MS Office Document
MD5: 778e19b7e204892e06ef2a03f90457df
Size: 620.03 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 778e19b7e204892e06ef2a03f90457df |
| Sha1 | 904c122b485f664c8c6d44f3f99aab3a12c84825 |
| Sha256 | 69e27f678552c5893efb10329cfce152bf818a4f48f8d180bc90f621b6ced317 |
| Sha384 | 23d17149919066816302fd6c9e6bf079f8c0dfc9cb0d17ba0a98cf9a7936f3a44ab285f54578568d15b61ebbffc3cde3 |
| Sha512 | ff9e8d92d68827bdf52addd3612f01d1a6fa62ff03cfe9e325e1a25f70dfec5d38c81f48b35ab377b83610dcdea5eaf20102e32bcdc4faf5a8f806ae5901661b |
| SSDeep | 12288:Nw00000000000S02tGboHTdPjA1NprcL3IzOGZI1/PzvyndfswP1+gNo0cOi9:NxozdPJ/PedfswtW |
| TLSH | 9CD4230973C5ED9FEA838E784AC2D0FA555CAC96DF46D57B7A14330E5A3373086132A4 |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
11 / 11
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>img
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>img
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | HtTp:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.3 |
| Author | dipak |
| CreationDate | D:20260905130956+05'30' |
| Creator | PScript5.dll Version 5.2.2 |
| ModifiedDate | D:20260905130956+05'30' |
| Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| Producer | GPL Ghostscript 9.06 |
| /Producer | GPL Ghostscript 9.06 |
| /CreationDate | D:20260905130956+05'30' |
| /ModDate | D:20260905130956+05'30' |
| /Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| /Creator | PScript5.dll Version 5.2.2 |
| /Author | dipak |
| Version | 1.4 |
| CreationDate | D:20260910044932+00'00' |
| Creator | |
| ModifiedDate | D:20260910044932+00'00' |
| Title | SLES CALIBRATION PRIVATE LIMITED |
| Producer | Skia/PDF m152 |
| Version | 1.3 |
| Author | dipak |
| CreationDate | D:20260905130956+05'30' |
| Creator | PScript5.dll Version 5.2.2 |
| ModifiedDate | D:20260905130956+05'30' |
| Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| Producer | GPL Ghostscript 9.06 |
| /Title | SLES CALIBRATION PRIVATE LIMITED |
| /Creator | |
| /Producer | Skia/PDF m152 |
| /CreationDate | D:20260910044932+00'00' |
| /ModDate | D:20260910044932+00'00' |
| /Producer | GPL Ghostscript 9.06 |
| /CreationDate | D:20260905130956+05'30' |
| /ModDate | D:20260905130956+05'30' |
| /Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| /Creator | PScript5.dll Version 5.2.2 |
| /Author | dipak |
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | HtTp:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
You must be signed in to view YARA rules.