Suspicious
Suspect

8f8eefcab7190efc401abbed9d9950f4

MS Office Document
MD5: 8f8eefcab7190efc401abbed9d9950f4
Size: 989.18 KB
application/vnd.ms-office

This sample is a 966 KB MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 44 embedded or derived files. It matches 4 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
b8eca270e07e96f414a4a5ff00c099f1518a9d10ca2f1a4c69800e37b9699fea
MD5
8f8eefcab7190efc401abbed9d9950f4
Verdict
Inconclusive
File type
MS Office Document · 966 KB

Cite this report: https://app.malva.re/sha256/b8eca270e07e96f414a4a5ff00c099f1518a9d10ca2f1a4c69800e37b9699fea

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
989.18 KB · 989,184 B
First seen
2026-07-21 06:31 · 3 months ago
Last seen
2026-07-21 06:31 · 3 months ago
Last analysis
2026-07-21 13:47 · 3 months ago
Hashes
MD5 8f8eefcab7190efc401abbed9d9950f4 Sha1 e02ca1f851d0ac8d6ed8b05d1aa0da9849828f1e Sha256 b8eca270e07e96f414a4a5ff00c099f1518a9d10ca2f1a4c69800e37b9699fea Sha384 e8d836a4b87b15fb198b4782362f957190efde1278ca9bcf66c7b094971a3d489c14fc81e17ce27bacfa6be8a86c4cc5 Sha512 771f3015f1f173e266af195955ce7c34b7ced90201adcefa4d530d3fadbc6c38d5f6453cd9f620875da3f6171722f262ebed00a64fc96a5cb976045e35a420b6 SSDeep 12288:ZGfwI82f25OdTezN4ee+KahN0QwKF2UElH7k1kyaNsUrS/RQs9ezhg55PZKbs0uB:YfwI/u+eR4eNK1QwKFgEvKhgDZKbs/ TLSH A7252349FAFEEB21F1F691384935C50846CECE98A775824F326872045735B3E728E96C

45 files
OFF8f8eefcab7190efc401abbed9d9950f4
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD00039282
XLSPackage
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
XMLsharedStrings.xml
XMLstyles.xml
BINtheme
XMLtheme1.xml
BINworksheets
BIN_rels
XMLsheet1.xml.rels
XMLsheet1.xml
BINdrawings
BIN_rels
XMLvmlDrawing1.vml.rels
VMLvmlDrawing1.vml
BINmedia
EMFimage2.emf
EMFimage1.emf
BINembeddings
OFFoleObject2.bin
BINRoot Entry
BINOle
BINCompObj
PDFCONTENTS
BINText (Preview)
TXTPage #1
BIN#Stream obj 5 0
BIN#Stream obj 10 0
BIN#Stream obj 11 0
BIN#Stream obj 15 0
BIN#Stream obj 16 0
BIN#Stream obj 17 0
OFFoleObject1.bin
BINRoot Entry
PDFCONTENTS
BINText (Preview)
TXTPage #1
BIN#Stream obj 5 0
BIN#Stream obj 7 0
BIN#Stream obj 11 0
BIN#Stream obj 15 0
BIN#Stream obj 19 0
TXTStructure
BINprinterSettings
BINprinterSettings1.bin
BINdocProps
WMFthumbnail.wmf
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD00039283
BINOle
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 9 STICH kept: 1secondary ignored: 8
bin 4oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>oox:xlsx>oox:media>ole:doc
Shape ole:doc>oox:xlsx>oox:media>ole:doc
4 nodes

Name Value
Version
1.7
CreationDate
D:20250908110839
Creator
PDFium
Producer
PDFium
/CreationDate
D:20250908110839
/Creator
PDFium
/Producer
PDFium
Version
1.7
CreationDate
D:20250908111410
Creator
PDFium
Producer
PDFium
/CreationDate
D:20250908111410
/Creator
PDFium
/Producer
PDFium

45 files
OFF8f8eefcab7190efc401abbed9d9950f4
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙