Malicious
ZIP Archive
MD5:
Size: 0 B
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
6 malicious · 652 files
ZIP7b5bd27a1ca2f0c06cae607e2f5210cf
OFFRVTools.msi
BINRoot Entry
BIN䡀䌏䈯
BIN䄦㡥䆾䅤
OFFFILE_InstallMeAny
BINRoot Entry
BIN䡀䆒䑲
BIN䡀䌏䈯
BIN䡀㲞䈝䗻
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀䌍䏤䊲
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䋜䕲䆷䗸
BIN䡀䒌䗱䒵䠯
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䈝䗻䗜䏼䠨
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䄛䌧㫲䗸䒷䠱
BIN䡀䒌䗱䒵㮯䈹䗱
BIN䡀䕌䄨䈷䒏䇯䕨
BIN䡀䖖㪬䖶䐨䏥䠼
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䙎䑨㶷䓤䌳䊱
BIN䌋䄱䜵㾾㯳䇯㫵䑷
BIN䌋䄱䜵㿾㭜㮗㬝㰏
EXE䌋䄱䜵㶾㿜㭋㬙㭊㵕
BIN䌋䄱䜵㷾䚨䏏䕧䗋䠱
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䒌䗱䒵㬯䑲䌧䌷䑲
BIN䡀䒖䘧䈯䌜䑪䗤䕸䠨
BIN䡀䖖㪬䖶䐨䏥㷼䐤䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䌋䄱䜵㭾䉨䄋䑱䕨䌋䐷䓤
BIN䡀㿿䇶䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
VBS䌋䄱䜵㼾䗨䈗䗻䌍䏤䊲䙾䖥
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
VBS䌋䄱䜵㼾䗨䌙㻳䊨䖬䕷㿼䏤䈸䙾䖥
BIN䆒䑲䟾㥈㯃㧆㥍㤅㠏㤅㩄㣄㮀㮇䈾䈻
BINDigitalSignature
BIN㭿㦊㬁㯊㨍㧃㣄㦌㨊㬈㥀㫄㢋㩂㪎㪆䠌
BINSummaryInformation
BINMsiDigitalSignatureEx
EXE_044B82E6289DC5A2E35D8BA1B9F4210E
EXE_05D5AA7E4350E1771088ABE5F0EC4DAC
EXE_1354D0E01EAE18DFE051CB0A6152BE04
BIN_184DAAB7EC3C4E87A4D096A81483192A
BIN_1D121053C0CE46619C570BAEEDE16BB7
BIN_241F8550D7313F5D730D44098604B6A7
BIN_3EE9D044C075425C81DD7E5BDED97740
BIN_44822355868347C6B0AB7335858B9B1B
EXE_4ECC8554055CA579195AC72D6E4A4A6E
EXE_755F63359A7FED3673062D4BE4EEEB1F
EXE_7700C3DD020B3E866398FFC19B74DC85
EXE_81D57EF6096CA277B68DFD7853430352
EXE_8481DC9D8740A372971A875A6D7F1FB3
EXE_88AB4E9C9EAA8AB48E134688D2A5F218
EXE_916A3D9E2BA6AA273F6979BC42A0B100
EXE_9FA9C0CF533298FB916F01E8C1728E87
EXE_A321378C0723A249C79DAD49CF2290A1
EXE_AE4B52809020252C5AA0CF8FF393625D
EXE_AF2F573613A29B08EAF8D1BBE1ACCD53
BIN_B1BD15A321D1FE08B7E48632FE5F8187
BIN_B694B19E91F1480AA61E7D92A0AE2E58
EXE_B87382FCA5C153702794B52A6D35450F
EXE_C41A35C6A37CD084859E3CB2E70AE9DA
RTF_D0CDE47E90F54893845E85E70312E181
EXE_D71D65078B87897EC309110E3C193843
EXE_D993EAC9652D6B277EC1D3AD9386A898
EXE_DBB36C507EA404A8B6D41FAD5562907B
BIN_E107A392B92B481CA766BF48D2548406
BIN_EC8BD2B2343E8DC25C77455CCFAFE1DF
PDF_F14A379D2D214949AE2A09418C1C5012
EXE_F2206E6CDB93645A2ADF71529E089B36
EXE_F5E8C90CE968B3FD3385208B479FE43C
EXE_FD9BA260F6E682E262FA42F3C05C6925
EXEFILE_InstallMeDll
EXEFILE_InstallMeExe
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䈛㵪䆲䗤䕲
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀䓊㼳䄨䆵䠫
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINDigitalSignature
BINSummaryInformation
BINMsiDigitalSignatureEx
BINFILE_InstallMeAny
BINFILE_InstallMeDll
BINFILE_InstallMeExe
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| _F14A379D2D214949AE2A09418C1C5012 | 1.7 |
| _F14A379D2D214949AE2A09418C1C5012 | Rob de Veij |
| _F14A379D2D214949AE2A09418C1C5012 | D:20240930143555+01'00' |
| _F14A379D2D214949AE2A09418C1C5012 | Microsoft® Word for Microsoft 365 |
| _F14A379D2D214949AE2A09418C1C5012 | D:20240930143555+01'00' |
| _F14A379D2D214949AE2A09418C1C5012 | RVTools 4.7.1 October 3, 2024 |
| _F14A379D2D214949AE2A09418C1C5012 | Microsoft® Word for Microsoft 365 |
| _F14A379D2D214949AE2A09418C1C5012 | true |
| _F14A379D2D214949AE2A09418C1C5012 | 2023-10-13T16:49:30Z |
| _F14A379D2D214949AE2A09418C1C5012 | Privileged |
| _F14A379D2D214949AE2A09418C1C5012 | Public No Visual Label |
| _F14A379D2D214949AE2A09418C1C5012 | 945c199a-83a2-4e80-9f8c-5a91be5752dd |
| _F14A379D2D214949AE2A09418C1C5012 | 99a04929-6196-4e8e-ba9f-4d322af4fd51 |
| _F14A379D2D214949AE2A09418C1C5012 | 0 |
| _F14A379D2D214949AE2A09418C1C5012 | RVTools 4.7.1 October 3, 2024 |
| _F14A379D2D214949AE2A09418C1C5012 | Rob de Veij |
| _F14A379D2D214949AE2A09418C1C5012 | Microsoft® Word for Microsoft 365 |
| _F14A379D2D214949AE2A09418C1C5012 | D:20240930143555+01'00' |
| _F14A379D2D214949AE2A09418C1C5012 | D:20240930143555+01'00' |
| _F14A379D2D214949AE2A09418C1C5012 | Microsoft® Word for Microsoft 365 |
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #7
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #9
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #10
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #12
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #13
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #14
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #15
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #16
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #17
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #18
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
icarhuhuhuhu
PDB Path
PATH
?huhuhuhu
PDB Path
PATH
D:\Sofhuhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
C:\Codhuhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
F:\gs2huhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
F:\azahuhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
C:\prohuhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
E:\A\_huhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
E:\A\_huhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
/_/objhuhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
/_/Srchuhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
C:\prohuhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
/_/arthuhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
C:\Codhuhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
E:\A\_huhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
Systemhuhuhuhuhuhuhu
PDB Path
PATH
F:\azahuhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
F:\azahuhuhuhuhuhuhuhuhuhuhu
PDB Path
PATH
/_/objhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential