Malicious
a3bb2c8db10dba1b77e733f6c123f837
MS Office Document
MD5: a3bb2c8db10dba1b77e733f6c123f837
Size: 10.66 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | a3bb2c8db10dba1b77e733f6c123f837 |
| Sha1 | 02a65f5e980c5a67128795c3ab08499c82432511 |
| Sha256 | 27e1594334eabcf7d927fb444dabc1f4221a36a8faf13b741ac65a9b1a23c87b |
| Sha384 | 9e0194f017b47f95289b1a96d676e4596fc95aae390492b2321602cd37b339cbca37caff6c3d4d5e33074d0cf1fb330b |
| Sha512 | de3667bb5590df5430e95f043c13b75e50345e444860f292113ccd6687fa90101901c2ac40a48ae1782f38b397d60d5128539e8db3efe3923b56e87649574331 |
| SSDeep | 196608:fJ0J36ikBL3FccXm2Hnzesf/2HB7wM+2EQREIFkLKmFkSAoKPIC6:fVljnzesf/Q7wQT2KmFkpBe |
| TLSH | FEB633F724A15E2BF4E1B07F08F7841F42713F826406645ED239BE466AF6A81A4FD1C9 |
Malicious
Malicious
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 15
STICH kept: 3secondary ignored: 12
bin
8img
4Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
ole:doc>ole:doc>scr:vbs~T1027~T1047~T1059.005
Shape
ole:doc>ole:doc>scr:vbs
malicious
3 nodes
Path
ole:doc>ole:doc>scr:vbs~T1027~T1059~T1059.005~T1112
Shape
ole:doc>ole:doc>scr:vbs
malicious
3 nodes
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.7 |
| Author | Rob de Veij |
| CreationDate | D:20260702105338+01'00' |
| Creator | Microsoft® Word for Microsoft 365 |
| ModifiedDate | D:20260702105338+01'00' |
| Title | RVTools 4.8.1 July 2, 2026 |
| Producer | Microsoft® Word for Microsoft 365 |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_Enabled | true |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_SetDate | 2023-10-13T16:49:30Z |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_Method | Privileged |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_Name | Public No Visual Label |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_SiteId | 945c199a-83a2-4e80-9f8c-5a91be5752dd |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_ActionId | 99a04929-6196-4e8e-ba9f-4d322af4fd51 |
| /MSIP_Label_dad3be33-4108-4738-9e07-d8656a181486_ContentBits | 0 |
| /Title | RVTools 4.8.1 July 2, 2026 |
| /Author | Rob de Veij |
| /Creator | Microsoft® Word for Microsoft 365 |
| /CreationDate | D:20260702105338+01'00' |
| /ModDate | D:20260702105338+01'00' |
| /Producer | Microsoft® Word for Microsoft 365 |
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
Malicious
Malicious
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › Root Entry › 䌋䄱䜵㼾䗨䈗䗻䌍䏤䊲䙾䖥
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › Root Entry › 䌋䄱䜵㼾䗨䌙㻳䊨䖬䕷㿼䏤䈸䙾䖥
URI
URI
http:/huhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
mailtohuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
mailtohuhuhuhuhuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
mailtohuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
mailtohuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
a3bb2c8db10dba1b77e733f6c123f837 › Decoy0 › _F14A379D2D214949AE2A09418C1C5012
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.