Malicious
MS Office Document
MD5: 7b75722e2a6c8502d6b2637bf0b4def7
Size: 555.52 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
555.52 KB · 555,520 B
First seen
2026-07-01 06:46 · 3 months ago
Last seen
2026-07-01 06:46 · 3 months ago
Last analysis
2026-07-02 00:33 · 3 months ago
Hashes
MD5
7b75722e2a6c8502d6b2637bf0b4def7
Sha1
0f8824b4d1637d10f53b1c712ced12923b4a8d9f
Sha256
d91c0e47050b3d3ae212b58ee8d38999664a9374c888302b0ec0a2edf5f96622
Sha384
f6f616615324222d632aa9469b12e0255b097f173346417f97684c2ea5757e314d56d27c00bc3429977a1fdd000269eb
Sha512
a9ce8a18b72bd61ad20b46c4f513df294c38ff111700c5e6dd6adb1a7bf3b3f8dd196d75cfd4d8986856e680bf2b68cec7e142b7e50d85f802cef8adba11bb0d
SSDeep
12288:0JxAPXRCp+79QG0WW7z2Eza2WzGoWCAsmp8paCwcG:2A/EdcvGoWlf
TLSH
FAC4236472C2FD0ACA27A33484A595C7811BFC638F86E7573624B34C90747E772672AE
4 malicious · 76 files
OFF7b75722e2a6c8502d6b2637bf0b4def7T1221
OFF[Repaired @0x00006E00]
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD001F4FF5
BINMBD001F4FF6
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
BINworksheets
BINmedia
BINembeddings
BINdrawings
XMLsharedStrings.xml
BINtheme
XMLstyles.xml
BINprinterSettings
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
BINCompObj
BINMBD001F4FF7
BIN_VBA_PROJECT_CUR
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| CONTENTS | 1.4 |
| CONTENTS | D:20260623140016+02'00' |
| CONTENTS | RICOH IM C3010 |
| CONTENTS | D:20260623140016+02'00' |
| CONTENTS | RICOH IM C3010 |
| CONTENTS | D:20260623140016+02'00' |
| CONTENTS | D:20260623140016+02'00' |
| CONTENTS | RICOH IM C3010 |
| CONTENTS | RICOH IM C3010 |
| CONTENTS | 1.7 |
| CONTENTS | Absa Retail |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | DocFusion |
| CONTENTS | D:20260622120032Z |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | Absa Retail |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential