Sign up free
Malicious
Malicious

961d5c4aebb2d4f0838b4c181607f112

Share on LinkedIn
Print
MS Office Document
MD5: 961d5c4aebb2d4f0838b4c181607f112
Size: 38.4 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

This sample is a 37.5 KB MS Office Document classified as malicious by Malva.RE. Static analysis extracted 85 embedded or derived files. It matches 106 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059, T1059.001, T1059.005 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
dde505f27b7a245044670679e49bab78c4b2629bcb56f265a0d79590327edcab
MD5
961d5c4aebb2d4f0838b4c181607f112
Verdict
Malicious
File type
MS Office Document · 37.5 KB
MITRE ATT&CK
T1027T1059T1059.001T1059.005T1059.007

Cite this report: https://app.malva.re/sha256/dde505f27b7a245044670679e49bab78c4b2629bcb56f265a0d79590327edcab

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document
Size
38.4 KB · 38,400 B
First seen
2026-11-03 11:30 · 5 hours ago
Last seen
2026-11-03 11:30 · 5 hours ago
Last analysis
2026-11-03 11:30 · 5 hours ago
Hashes
MD5 961d5c4aebb2d4f0838b4c181607f112 Sha1 e825903343323070b2ad7d0cb88fe3010dde3caa Sha256 dde505f27b7a245044670679e49bab78c4b2629bcb56f265a0d79590327edcab Sha384 47f97ab4b10cfe58b1d8b7a83ce4042d9bbdfa9250bde8715823377b30309256c7f1d17ed89aa6ab06bda3fc3879e998 Sha512 fd3f6704aff81e0c0d28826976b7381dd0f40257436f94f72bb3b3ea850857914c2f442b57b073ffa3a80be7a22fc8d0d670182f026232af66a4991c8e6ee166 SSDeep 768:uTfwwyh5BrLdzwl53L4h0eWMbCbGCSNqEMVN/0r:kqjBrJoi0obIJSS+ TLSH 22037C66B5009332C9070B354A5FDBD48F399C58AF532012BBE6B39C3D729A116FB9E4

61 malicious · 86 files
OFF961d5c4aebb2d4f0838b4c181607f112
VBSTqHF8cSvmUmx
VBSTqHF8cSvmUmx.deobfuscated.vbs
PS1X4eH91l13llA
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
JSZ84KENh_Gj4y
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 3secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path ole:doc>scr:ps1~T1027~T1059.001
Shape ole:doc>scr:ps1
malicious 2 nodes
Path ole:doc>scr:vbs~T1027~T1059~T1059.005
Shape ole:doc>scr:vbs
malicious 2 nodes

Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙