91d8673ba84a2b82b1f8465e587df721

MS Office Document

MD5: 91d8673ba84a2b82b1f8465e587df721

Size: 722.94 KB

application/vnd.ms-office

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

MD5	91d8673ba84a2b82b1f8465e587df721
Sha1	3abc46816d41f4a9ab2d0185b0a9fae6f5ff63a0
Sha256	b85ffbfa9fb459c707dd3a47c77f343652e7087c669f892f88cf3b73d172abc4
Sha384	5e2f8d6089421628b189ba7d8f6a3b2fc624bb35d575d8eff81f02a7eda0a7b50b6df5db61890196e79e4b0b1cbc0d64
Sha512	4e2bc5a4dea0d2ad6c6636c02e0e231f9c0629ed0ef05c2f28ac1417c8d702f1a0700d08d533b130d182265a76b2e8c001b93be89b3abad4b43a6a4beea8c971
SSDeep	12288:AEpTkokjm++R77gfJZT8IPpUsFz7A4/Hlo/xsG9WjkdMkotTst:lklCnNETnTz7A4/UsGlMHRst
TLSH	9CF42312F0E5A827E2774CB55AEAD90AB04CFDA07B1BE6477104B36D58B93E640C2C5F

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

10 / 10

Path ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>img

Shape ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>img

malicious 6 nodes

Path ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin

Shape ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin

malicious 6 nodes

Config. Field	Value
URL distante (OLE moniker) #1	HTtp:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Version	1.4
CreationDate	D:20260912033334-04'00'
Creator	RICOH MP C4504
ModifiedDate	D:20260912033334-04'00'
Producer	RICOH MP C4504
/CreationDate	D:20260912033334-04'00'
/ModDate	D:20260912033334-04'00'
/Creator	RICOH MP C4504
/Producer	RICOH MP C4504

Config. Field	Value
URL distante (OLE moniker) #1	HTtp:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

You must be signed in to view YARA rules.