Malicious
Malicious

Share on LinkedIn
Print
MS Office Document
MD5:
Size: 0 B
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

The file 9745d2f169e75a2c9fea30c8a1bbee42 is a MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 134 embedded or derived files and a malware configuration (Remote Template). It matches 5 YARA rules. Observed behaviours map to MITRE ATT&CK T1221. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
—
MD5
-
Verdict
Malicious
File type
MS Office Document
MITRE ATT&CK
T1221

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Microsoft Office Document

6 malicious · 135 files
OFF9745d2f169e75a2c9fea30c8a1bbee42
OFF[Repaired @0x000D6A00]
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD0098204E
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD0018AD33
XLSPackage
XML[Content_Types].xml
BINxl
XMLworkbook.xml
XMLstyles.xml
XMLsharedStrings.xml
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.rels
BINMBD0018B539
XLSPackage
XML[Content_Types].xml
BINxl
XMLworkbook.xml
XMLsharedStrings.xml
XMLstyles.xml
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.rels

Config. Field Value
Target file:/huhuhuhuhuhuhuhuhuhuhu
Path externhuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
Target file:/huhuhuhuhuhuhuhuhuhuhu
Path externhuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Remote Template - Highly Suspicious URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙