Suspicious
Suspect

7b1c28b82eda5ac362dd3d47dd3d0c88

MS Word Document
MD5: 7b1c28b82eda5ac362dd3d47dd3d0c88
Size: 92.8 KB
application/msword

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 7b1c28b82eda5ac362dd3d47dd3d0c88
Sha1 8737a7c0577b56f654a37de47e5e4644b4a1ea32
Sha256 1ecac1f3afd6d0553f2bde80a2cc9de5eb94cf5a87f90017426ee57ae512cfe8
Sha384 8eefd9afdd0faa68327fd09c7b0585f69ea4d69a84b86aa5d4ac36a759de74748a6677f83ea9dd26c89890fe5a320a06
Sha512 f734c5fd4b8ecbf1d8f567c814c5309d6c97711217c933fd6331815cb1b03fbb128d160d0d54d1cb24ec797d92ccde2537d2b38a814bebc7bccf8fe8691e2a03
SSDeep 1536:JHttPoXaPTQsMosVfb9f9iPGZf8dqQA1gA2i9u4ctfcNpxZBSrXt:hPoXsUbxfbviOZfiFwf2izGfipxZgrXt
TLSH 8593B06D417B49B5D81659A34FAC524040DE47C993BA306B68DC78ECEF43A73FAB2C24
7b1c28b82eda5ac362dd3d47dd3d0c88
[Content_Types].xml
docProps
app.xml
core.xml
word
document.xml
fontTable.xml
orps.rtf
settings.xml
styles.xml
webSettings.xml
theme
theme1.xml
_rels
document.xml.rels
_rels
.rels
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 5 STICH kept: 1secondary ignored: 4
oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path oox:docx>rtf
Shape oox:docx>rtf
2 nodes
7b1c28b82eda5ac362dd3d47dd3d0c88
[Content_Types].xml
docProps
app.xml
core.xml
word
document.xml
fontTable.xml
orps.rtf
settings.xml
styles.xml
webSettings.xml
theme
theme1.xml
_rels
document.xml.rels
_rels
.rels
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙