Malicious
8facc95104bc4284cc3b416abd0ee1fc
MS Word Document
MD5: 8facc95104bc4284cc3b416abd0ee1fc
Size: 147.7 KB
application/msword
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
147.7 KB · 147,697 B
First seen
2025-08-19 11:46 · one year ago
Last seen
2025-08-19 11:46 · one year ago
Last analysis
2025-08-19 12:29 · one year ago
Hashes
MD5
8facc95104bc4284cc3b416abd0ee1fc
Sha1
d81c25340a8ec69295dfd57ddd5c1266f2dd6951
Sha256
e2b5ec33a079a65f25dc69ec049e1fc670f66d13f6426906af06c0f74c251617
Sha384
0576fd98ef9107808b24769def30c582f2d7ee32ec4e127525018a0134613ed66aee7267a71cfe815665efaef8de6974
Sha512
4351d248cdc586d0cf7970490d870b69f70706ec358bf61a215366bbc8c538c39bc0f743e15414d481f1a928f4f2b18ed75c962dbd0bb040f45d7884f9a370ac
SSDeep
3072:iQy5A4u8W/sW727wNzFTpbzbgrV+yXY4Io8aWlJPbraeKO0K9bbuKwnpx:ijA4uz67uxTirWlBf0K98
TLSH
85E3025648D55847DF4982732A093E5DF0C9FD623991F18B3A00CFAEDE1BBACB217A05
2 malicious · 34 files
DOC8facc95104bc4284cc3b416abd0ee1fcT1221
XML[Content_Types].xml
BIN_rels
XML.rels
BINword
BIN_rels
XMLdocument.xml.rels
XMLheader2.xml.rels
XMLfooter2.xml.rels
OFFsettings.xml.relsT1221
XMLdocument.xml
XMLfootnotes.xml
XMLfooter2.xml
XMLfooter3.xml
XMLheader3.xml
XMLendnotes.xml
XMLheader2.xml
BINmedia
EMFimage1.emf
EMFimage2.emf
BINembeddings
OFFMicrosoft_Office_Excel_97-2003_Worksheet1.xls
BINRoot Entry
BINOle
BINEPRINT
BINCompObj
BINObjInfo
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
OFFMicrosoft_Office_Excel_97-2003_Worksheet2.xls
BINRoot Entry
BINEPRINT
BINSummaryInformation
BINtheme
XMLtheme1.xml
XMLsettings.xml
XMLstyles.xml
XMLwebSettings.xml
XMLfontTable.xml
BINdocProps
XMLapp.xml
XMLcore.xml
| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | settihuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential2 malicious · 34 files
DOC8facc95104bc4284cc3b416abd0ee1fcT1221
XML[Content_Types].xml
BIN_rels
BINword
BIN_rels
XMLdocument.xml.rels
XMLheader2.xml.rels
XMLfooter2.xml.rels
OFFsettings.xml.relsT1221
XMLdocument.xml
XMLfootnotes.xml
XMLfooter2.xml
XMLfooter3.xml
XMLheader3.xml
XMLendnotes.xml
XMLheader2.xml
BINmedia
BINembeddings
BINtheme
XMLsettings.xml
XMLstyles.xml
XMLwebSettings.xml
XMLfontTable.xml
BINdocProps
| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | settihuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
8facc95104bc4284cc3b416abd0ee1fc › word › _rels › settings.xml.rels
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account