Malicious
PDF @0x00000000
MS Office Document
MD5: 87eb0a1a6b07479bc1065576d10ccf53
Size: 920.58 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
920.58 KB · 920,576 B
First seen
2026-08-06 14:31 · 2 months ago
Last seen
2026-08-06 14:31 · 2 months ago
Last analysis
2026-08-06 17:07 · 2 months ago
Hashes
MD5
87eb0a1a6b07479bc1065576d10ccf53
Sha1
acf1f46a59a8c675eafb52051956322aaecdb763
Sha256
32f7eefee64db549de9a1299ae677db39d34df0736d6bd3f1b69dcd1a67284a9
Sha384
a077980e0198a8ef7d7835403e5e295735e0622fccf0e472f095644bf6d90d3c2db5827f4e7880195f70f5ae24d8bc56
Sha512
0a6bf0b7ab3638a659d89266caf454af4fde2e187d6bf136bb7a1817d0054056bc8d44461f77ac0452c22cb424a11ea690f7a9c97630ecc8d2e5268871dc094e
SSDeep
12288:DrKPdVpw2F1J+RT/II8fp4rm4y+ev5B95S1UiXFZYeC/FF1anBTNex4Ae5rcMoTb:/Kdt1QRT/64rmFu1UiVNC/z1yPkUrwr
TLSH
6A151211EF848937CDD297380B9372C5E60DFC679E6B4B0A57487369783B6F4A861C0A
3 malicious · 81 files
OFF87eb0a1a6b07479bc1065576d10ccf53T1221
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD003D5391
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD00233248
BINOle
BINCompObj
PDFCONTENTS
BINText (Preview)
TXTPage #1
TXTPage #2
BIN#Stream obj 13 0
BIN#Stream obj 14 0
IMG#Stream obj 5 0
EXIF#Stream obj 5 0.exif
IMG#Stream obj 5 0-preview.png
BIN#Stream obj 9 0
BIN#Stream obj 6 0
BIN#Stream obj 8 0
BIN#Stream obj 17 0
BINMBD003D5392
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
XMLstyles.xml
BINdrawings
BIN_rels
XMLvmlDrawing1.vml.rels
VMLvmlDrawing1.vml
BINworksheets
BIN_rels
XMLsheet1.xml.rels
XMLsheet1.xml
BINtheme
XMLtheme1.xml
BINmedia
EMFimage1.emf
XMLsharedStrings.xml
BINembeddings
OFFoleObject1.bin
BINRoot Entry
PDFCONTENTS
BINText (Preview)
TXTPage #1
TXTPage #2
TXTPage #3
TXTPage #4
BIN#Stream obj 4 0
BIN#Stream obj 14 0
BIN#Stream obj 10 0
BIN#Stream obj 47 0
BIN#Stream obj 49 0
BIN#Stream obj 52 0
BIN#Stream obj 54 0
BIN#Stream obj 63 0
BIN#Stream obj 65 0
BIN#Stream obj 68 0
BIN#Stream obj 70 0
BIN#Stream obj 73 0
BIN#Stream obj 75 0
BIN#Stream obj 13 0
BIN#Stream obj 20 0
BIN#Stream obj 78 0
BIN#Stream obj 80 0
BIN#Stream obj 83 0
BIN#Stream obj 85 0
BIN#Stream obj 57 0
BIN#Stream obj 59 0
BIN#Stream obj 26 0
BIN#Stream obj 30 0
BIN#Stream obj 34 0
BIN#Stream obj 41 0
BIN#Stream obj 44 0
BIN#Stream obj 46 0
BIN#Stream obj 93 0
TXTStructure
BINprinterSettings
BINprinterSettings1.bin
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD003D5393
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 12
STICH kept: 2secondary ignored: 10
bin
5img
1oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>oox:xlsx>oox:rel:ext~T1221
Shape
ole:doc>oox:xlsx>oox:rel:ext
technique3 nodes
Path
ole:doc>oox:xlsx>oox:media>ole:doc
Shape
ole:doc>oox:xlsx>oox:media>ole:doc
4 nodes
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.7 |
| CreationDate | D:20260731145050-04'00 |
| Creator | Mozilla Firefox 153.0.1 |
| Producer | cairo 1.18.4 (https://cairographics.org) |
| /Producer | cairo 1.18.4 (https://cairographics.org) |
| /Creator | Mozilla Firefox 153.0.1 |
| /CreationDate | D:20260731145050-04'00 |
| Version | 1.6 |
| Producer | Oracle BI Publisher 12.2.1.4.0 |
| /Producer | Oracle BI Publisher 12.2.1.4.0 |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 81 files
OFF87eb0a1a6b07479bc1065576d10ccf53T1221
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD003D5391
BINMBD003D5392
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
XMLstyles.xml
BINdrawings
BINworksheets
BINtheme
BINmedia
XMLsharedStrings.xml
BINembeddings
BINprinterSettings
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
BINCompObj
BINMBD003D5393
BIN_VBA_PROJECT_CUR
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
87eb0a1a6b07479bc1065576d10ccf53 › Root Entry › MBD003D5392 › Package › xl › externalLinks › _rels › externalLink1.xml.rels
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account