Malicious
Malicious

961d5c4aebb2d4f0838b4c181607f112

MS Office Document
MD5: 961d5c4aebb2d4f0838b4c181607f112
Size: 38.4 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

This sample is a 37.5 KB MS Office Document classified as malicious by Malva.RE. Static analysis extracted 85 embedded or derived files. It matches 106 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059, T1059.001, T1059.005 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
dde505f27b7a245044670679e49bab78c4b2629bcb56f265a0d79590327edcab
MD5
961d5c4aebb2d4f0838b4c181607f112
Verdict
Malicious
File type
MS Office Document · 37.5 KB
MITRE ATT&CK
T1027T1059T1059.001T1059.005T1059.007

Cite this report: https://app.malva.re/sha256/dde505f27b7a245044670679e49bab78c4b2629bcb56f265a0d79590327edcab

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
38.4 KB · 38,400 B
First seen
2026-11-03 11:30 · 6 hours ago
Last seen
2026-11-03 11:30 · 6 hours ago
Last analysis
2026-11-03 11:30 · 6 hours ago
Hashes
MD5 961d5c4aebb2d4f0838b4c181607f112 Sha1 e825903343323070b2ad7d0cb88fe3010dde3caa Sha256 dde505f27b7a245044670679e49bab78c4b2629bcb56f265a0d79590327edcab Sha384 47f97ab4b10cfe58b1d8b7a83ce4042d9bbdfa9250bde8715823377b30309256c7f1d17ed89aa6ab06bda3fc3879e998 Sha512 fd3f6704aff81e0c0d28826976b7381dd0f40257436f94f72bb3b3ea850857914c2f442b57b073ffa3a80be7a22fc8d0d670182f026232af66a4991c8e6ee166 SSDeep 768:uTfwwyh5BrLdzwl53L4h0eWMbCbGCSNqEMVN/0r:kqjBrJoi0obIJSS+ TLSH 22037C66B5009332C9070B354A5FDBD48F399C58AF532012BBE6B39C3D729A116FB9E4

61 malicious · 86 files
OFF961d5c4aebb2d4f0838b4c181607f112
BINRoot Entry
BIN䡀䌏䈯
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䋜䕲䆷䗸
BIN䡀䕙䓲䕨䜷
BIN䕙䇲䆸䞷䄦䠥
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
VBSTqHF8cSvmUmx
VBSTqHF8cSvmUmx.deobfuscated.vbs
PS1X4eH91l13llA
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
JSZ84KENh_Gj4y
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 3secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path ole:doc>scr:ps1~T1027~T1059.001
Shape ole:doc>scr:ps1
malicious 2 nodes
Path ole:doc>scr:vbs~T1027~T1059~T1059.005
Shape ole:doc>scr:vbs
malicious 2 nodes

Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

61 malicious · 86 files
OFF961d5c4aebb2d4f0838b4c181607f112
VBSTqHF8cSvmUmx
VBSTqHF8cSvmUmx.deobfuscated.vbs
PS1X4eH91l13llA
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
JSZ84KENh_Gj4y
No malware configuration was found at this point.

Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
961d5c4aebb2d4f0838b4c181607f112 › TqHF8cSvmUmx
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙