Malicious
91a3ab2ed8358ae710979a568f72731e
MS Office Document
MD5: 91a3ab2ed8358ae710979a568f72731e
Size: 568.83 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
This sample is a 555.5 KB MS Office Document classified as malicious by Malva.RE. Static analysis extracted 69 embedded or derived files and a malware configuration (Template/objet distant (CVE-2017-0199)). It matches 4 YARA rules. Observed behaviours map to MITRE ATT&CK T1204 and T1221. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- ea1fac130fa927b287ec2b2ed21a794194277bdb8c55e8f65340720e0e240428
- MD5
- 91a3ab2ed8358ae710979a568f72731e
- Verdict
- Malicious
- File type
- MS Office Document · 555.5 KB
Cite this report: https://app.malva.re/sha256/ea1fac130fa927b287ec2b2ed21a794194277bdb8c55e8f65340720e0e240428
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
568.83 KB · 568,832 B
First seen
2026-10-26 14:00 · 10 hours ago
Last seen
2026-10-26 14:00 · 10 hours ago
Last analysis
2026-10-26 14:00 · 10 hours ago
Hashes
MD5
91a3ab2ed8358ae710979a568f72731e
Sha1
5141213c3e6273e48db69961534079fb26edcad9
Sha256
ea1fac130fa927b287ec2b2ed21a794194277bdb8c55e8f65340720e0e240428
Sha384
d06d7c168403ea6be41d3c168fedc92dc1060538a93f77eac91351b386748ec56ab1f744bdb3f8a08adbceb9cb8f79c4
Sha512
2899133857c5b6841e99e552198f53d41afc81a8516953951407e66e292f9bfec9b215685e3d4f5bac303d215fca424a2f7c9b5b26b0a8509fb1ca7ed1f439b8
SSDeep
12288:K1ViyO1UAV/K7sqcKnGqC3gz/jRmxKnu1ugbvH:byQU4K7rh3CwbdKKnSHD
TLSH
B9C42324B1E29F53D10347388DD8C4ABB18EBD16EF45921373847B6F137DBAA864690E
1 malicious · 70 files
OFF91a3ab2ed8358ae710979a568f72731eT1204 · T1221CVE-2017-0199
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD005E0537
XLSPackage
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
XMLsharedStrings.xml
BINdrawings
BIN_rels
XMLvmlDrawing1.vml.rels
VMLvmlDrawing1.vml
XMLdrawing1.xml
BINworksheets
BIN_rels
XMLsheet1.xml.rels
XMLsheet1.xml
BINtheme
XMLtheme1.xml
XMLstyles.xml
BINmedia
EMFimage1.emf
BINembeddings
OFFoleObject1.bin
BINRoot Entry
BINOle
BINCompObj
PDFCONTENTS
BINText (Preview)
TXTPage #1
BIN#Stream obj 51 0
BIN#Stream obj 117 0
BIN#Stream obj 41 0
BIN#Stream obj 50 0
BIN#Stream obj 137 0
BIN#Stream obj 138 0
BIN#Stream obj 133 0
BIN#Stream obj 39 0
BIN#Stream obj 48 0
BIN#Stream obj 147 0
BIN#Stream obj 148 0
BIN#Stream obj 149 0
BIN#Stream obj 150 0
BIN#Stream obj 151 0
BIN#Stream obj 75 0
BIN#Stream obj 76 0
BIN#Stream obj 71 0
BIN#Stream obj 82 0
BIN#Stream obj 83 0
BIN#Stream obj 78 0
BIN#Stream obj 95 0
BIN#Stream obj 96 0
BIN#Stream obj 91 0
BIN#Stream obj 102 0
BIN#Stream obj 103 0
BIN#Stream obj 98 0
BIN#Stream obj 123 0
BIN#Stream obj 124 0
BIN#Stream obj 119 0
BIN#Stream obj 130 0
BIN#Stream obj 131 0
BIN#Stream obj 126 0
BIN#Stream obj 146 0
BIN#Stream obj 145 0
BIN#Stream obj 144 0
BIN#Stream obj 152 0
TXTStructure
BINprinterSettings
BINprinterSettings1.bin
BINdocProps
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD005E0538
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
9 / 9
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>bin
Shape
ole:doc>oox:xlsx>oox:media>bin
malicious
4 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.6 |
| CreationDate | D:20260627095150+06'00' |
| ModifiedDate | D:20261013190014+06'00' |
| /CreationDate | D:20260627095150+06'00' |
| /ModDate | D:20261013190014+06'00' |
1 malicious · 70 files
OFF91a3ab2ed8358ae710979a568f72731eT1204 · T1221CVE-2017-0199
BINRoot Entry
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account