Malicious
Malicious

PDF @0x00000000

MS Office Document
MD5: 7b75722e2a6c8502d6b2637bf0b4def7
Size: 555.52 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
555.52 KB · 555,520 B
First seen
2026-07-01 06:46 · 3 months ago
Last seen
2026-07-01 06:46 · 3 months ago
Last analysis
2026-07-02 00:33 · 3 months ago
Hashes
MD5 7b75722e2a6c8502d6b2637bf0b4def7 Sha1 0f8824b4d1637d10f53b1c712ced12923b4a8d9f Sha256 d91c0e47050b3d3ae212b58ee8d38999664a9374c888302b0ec0a2edf5f96622 Sha384 f6f616615324222d632aa9469b12e0255b097f173346417f97684c2ea5757e314d56d27c00bc3429977a1fdd000269eb Sha512 a9ce8a18b72bd61ad20b46c4f513df294c38ff111700c5e6dd6adb1a7bf3b3f8dd196d75cfd4d8986856e680bf2b68cec7e142b7e50d85f802cef8adba11bb0d SSDeep 12288:0JxAPXRCp+79QG0WW7z2Eza2WzGoWCAsmp8paCwcG:2A/EdcvGoWlf TLSH FAC4236472C2FD0ACA27A33484A595C7811BFC638F86E7573624B34C90747E772672AE
4 malicious · 76 files
OFF7b75722e2a6c8502d6b2637bf0b4def7
OFF[Repaired @0x00006E00]
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD001F4FF5
BINOle
BINCompObj
PDFCONTENTS
BIN#Stream {UglyToad.PdfPig.Core.XrefLocation}
BINText (Preview)
TXTPage #1
TXTStructure
BINMBD001F4FF6
XLSPackage
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
BINworksheets
XMLsheet4.xml
XMLsheet2.xml
XMLsheet3.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet7.xml.rels
XMLsheet6.xml.rels
XMLsheet5.xml.rels
XMLsheet4.xml.rels
XMLsheet1.xml
XMLsheet13.xml
XMLsheet12.xml
XMLsheet11.xml
XMLsheet10.xml
XMLsheet9.xml
XMLsheet8.xml
XMLsheet7.xml
XMLsheet6.xml
XMLsheet5.xml
XMLsheet14.xml
XMLsheet15.xml
XMLsheet16.xml
BINmedia
EMFimage1.emf
BINembeddings
OFFoleObject1.bin
BINRoot Entry
PDFCONTENTS
BIN#Stream {UglyToad.PdfPig.Core.XrefLocation}
BINText (Preview)
TXTPage #1
TXTPage #2
TXTPage #3
TXTPage #4
TXTPage #5
TXTPage #6
TXTPage #7
TXTPage #8
TXTPage #9
TXTPage #10
TXTPage #11
BINdrawings
VMLvmlDrawing1.vml
BIN_rels
XMLvmlDrawing1.vml.rels
XMLsharedStrings.xml
BINtheme
XMLtheme1.xml
XMLstyles.xml
BINprinterSettings
BINprinterSettings4.bin
BINprinterSettings2.bin
BINprinterSettings3.bin
BINprinterSettings1.bin
BINprinterSettings5.bin
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.rels
BINdocProps
WMFthumbnail.wmf
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD001F4FF7
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
Config. Field Value
Target file:/huhuhuhuhuhuhuhuhuhuhu
Path externhuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
CONTENTS
1.4
CONTENTS
D:20260623140016+02'00'
CONTENTS
RICOH IM C3010
CONTENTS
D:20260623140016+02'00'
CONTENTS
RICOH IM C3010
CONTENTS
D:20260623140016+02'00'
CONTENTS
D:20260623140016+02'00'
CONTENTS
RICOH IM C3010
CONTENTS
RICOH IM C3010
CONTENTS
1.7
CONTENTS
Absa Retail
CONTENTS
D:20260622120032Z
CONTENTS
DocFusion
CONTENTS
D:20260622120032Z
CONTENTS
DocFusion
CONTENTS
DocFusion
CONTENTS
D:20260622120032Z
CONTENTS
D:20260622120032Z
CONTENTS
DocFusion
CONTENTS
Absa Retail
Remote Template - Highly Suspicious URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
URI URI
mailtohuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
4 malicious · 76 files
OFF7b75722e2a6c8502d6b2637bf0b4def7
OFF[Repaired @0x00006E00]
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD001F4FF6
XLSPackage
XML[Content_Types].xml
BINxl
XMLworkbook.xml
XMLsharedStrings.xml
XMLstyles.xml
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.rels
BINCompObj
Config. Field Value
Target file:/huhuhuhuhuhuhuhuhuhuhu
Path externhuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Remote Template - Highly Suspicious URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
7b75722e2a6c8502d6b2637bf0b4def7 › Root Entry › MBD001F4FF6 › Package › xl › externalLinks › _rels › externalLink1.xml.rels
URI URI
mailtohuhuhuhuhuhuhu
7b75722e2a6c8502d6b2637bf0b4def7 › Root Entry › MBD001F4FF6 › Package › xl › embeddings › oleObject1.bin › Root Entry › CONTENTS
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙