Malicious
MS Word Document
MD5:
Size: 0 B
application/msword
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
4 malicious · 63 files
DOC9547e74331a414d8fccb5f25b5469731T1221
XML[Content_Types].xml
BIN_rels
BINword
BIN_rels
XMLdocument.xml.rels
XMLheader2.xml.rels
XMLfooter2.xml.rels
OFFsettings.xml.relsT1221
XMLdocument.xml
XMLfootnotes.xml
XMLfooter2.xml
XMLfooter3.xml
XMLheader3.xml
XMLendnotes.xml
XMLheader2.xml
BINmedia
BINembeddings
XLSMicrosoft_Office_Excel_Worksheet1.xlsxT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
BINworksheets
XMLsheet4.xml
BIN_rels
OFFsheet2.xml.relsT1221
XMLsheet2.xml
XMLsheet3.xml
XMLsheet5.xml
XMLsheet1.xml
XMLsharedStrings.xml
XMLstyles.xml
BINtheme
BINdocProps
XLSMicrosoft_Office_Excel_Worksheet2.xlsx
BINtheme
XMLsettings.xml
XMLstyles.xml
XMLwebSettings.xml
XMLfontTable.xml
BINdocProps
| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | settihuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | sheethuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | sheethuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | sheethuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | sheethuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | sheethuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | sheethuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | sheethuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | sheethuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | sheethuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious Document RelationShip
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious Document RelationShip
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential