Malicious
Malicious

a4437999e35b4d86f0e676b3baca8a81

MS Office Document
MD5: a4437999e35b4d86f0e676b3baca8a81
Size: 1.51 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
1.51 MB · 1,508,864 B
First seen
2026-07-11 07:01 · 3 months ago
Last seen
2026-07-11 07:01 · 3 months ago
Last analysis
2026-07-11 07:02 · 3 months ago
Hashes
MD5 a4437999e35b4d86f0e676b3baca8a81 Sha1 4438ff729d980bbea78e69aad315f8c015c7e3be Sha256 4bb16555c6d16051154f98850757d5eacfefcd07031cdde2054e574f988e8c5b Sha384 b9a60f6cc46bf7fd20e61842ff41fa5d37f745edaa13c01005aef9cb16d43eb50c8bada6f98803f4693a20a881fddb08 Sha512 0660f3f75a7d4e3657f6e4ae9104f8256458854d65a37f2ff890953cc27f2c9fb7db3aaa6d873d5bd9fc71a429c0dc2a65f0656a3415b30ab25a43c37d0bb4e7 SSDeep 24576:oNB31xX9tIbrZZDI0tHPAcHutnBQsPgIDmdUbeSEBW3uzzZOfOxaEQDo0e:m31xN2ZZ/fOwsZaOeSM8sI3e TLSH F2652307ABD1BB1AC19F89386C9798B4015EBC16F806891B33887B5C347F795878B64E
4 malicious · 105 files
OFFa4437999e35b4d86f0e676b3baca8a81
OFF[Repaired @0x0004A200]
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD00129ACB
XLSPackage
XML[Content_Types].xml
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
BINworksheets
XMLsheet4.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet5.xml.rels
XMLsheet4.xml.rels
XMLsheet2.xml
XMLsheet3.xml
XMLsheet5.xml
XMLsheet1.xml
BINdrawings
BIN_rels
XMLdrawing1.xml.rels
XMLdrawing2.xml.rels
XMLvmlDrawing1.vml.rels
XMLdrawing5.xml.rels
VMLvmlDrawing1.vml
XMLdrawing5.xml
XMLdrawing1.xml
XMLdrawing4.xml
XMLdrawing2.xml
XMLdrawing3.xml
BINmedia
EMFimage4.emf
IMGimage3.jpeg
IMGimage3.jpeg-preview.png
IMGimage1.jpeg
IMGimage1.jpeg-preview.png
IMGimage2.jpeg
IMGimage2.jpeg-preview.png
BINembeddings
OFFMicrosoft_Office_Excel_97-2003_Worksheet1.xls
BINRoot Entry
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
XMLsharedStrings.xml
XMLstyles.xml
BINtheme
XMLtheme1.xml
BINprinterSettings
BINprinterSettings1.bin
BINprinterSettings4.bin
BINprinterSettings3.bin
BINdocProps
WMFthumbnail.wmf
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD00129ACC
XLSPackage
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
XMLstyles.xml
BINmedia
EMFimage2.emf
EMFimage1.emf
BINtheme
XMLtheme1.xml
BINworksheets
BIN_rels
XMLsheet1.xml.rels
XMLsheet1.xml
BINdrawings
BIN_rels
XMLvmlDrawing1.vml.rels
VMLvmlDrawing1.vml
BINembeddings
OFFoleObject1.bin
BINRoot Entry
BINOle
BINCompObj
PDFCONTENTS
BINText (Preview)
TXTPage #1
TXTPage #2
BIN#Stream obj 9 0
BIN#Stream obj 15 0
BIN#Stream obj 17 0
BIN#Stream obj 20 0
BIN#Stream obj 21 0
BIN#Stream obj 24 0
BIN#Stream obj 25 0
BIN#Stream obj 28 0
BIN#Stream obj 29 0
BIN#Stream obj 32 0
BIN#Stream obj 3 0
BIN#Stream obj 4 0
BIN#Stream obj 12 0
OFFoleObject2.bin
BINRoot Entry
PDFCONTENTS
BINText (Preview)
TXTPage #1
BIN#Stream obj 9 0
BIN#Stream obj 7 0
BIN#Stream obj 5 0
BIN#Stream obj 6 0
BIN#Stream obj 1 0
BIN#Stream obj 2 0
TXTStructure
XMLsharedStrings.xml
BINexternalLinks
BIN_rels
OFFexternalLink1.xml.rels
XMLexternalLink1.xml
BINprinterSettings
BINprinterSettings1.bin
BINdocProps
WMFthumbnail.wmf
XMLcore.xml
XMLapp.xml
BINMBD00129ACD
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
Config. Field Value
Target file:/huhuhuhuhuhuhuhuhuhuhu
Path externhuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Version
1.5
CreationDate
D:20260623125600Z
Title
Proof Of Payment
Producer
OpenPDF 2.0.2
/CreationDate
D:20260623125600Z
/Producer
OpenPDF 2.0.2
/Title
Proof Of Payment
Version
1.4
CreationDate
D:20260623205340+08'00'
Creator
JasperReports Library version 6.1.0
ModifiedDate
D:20260623205340+08'00'
Producer
iText 2.1.7 by 1T3XT
/ModDate
D:20260623205340+08'00'
/Creator
JasperReports Library version 6.1.0
/CreationDate
D:20260623205340+08'00'
/Producer
iText 2.1.7 by 1T3XT
Remote Template - Highly Suspicious URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
4 malicious · 105 files
OFFa4437999e35b4d86f0e676b3baca8a81
OFF[Repaired @0x0004A200]
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD00129ACC
XLSPackage
XML[Content_Types].xml
BINxl
XMLworkbook.xml
XMLstyles.xml
XMLsharedStrings.xml
BINexternalLinks
BIN_rels
OFFexternalLink1.xml.rels
XMLexternalLink1.xml
Config. Field Value
Target file:/huhuhuhuhuhuhuhuhuhuhu
Path externhuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Remote Template - Highly Suspicious URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
a4437999e35b4d86f0e676b3baca8a81 › Root Entry › MBD00129ACC › Package › xl › externalLinks › _rels › externalLink1.xml.rels
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙