Malicious
MS Office Document
MD5: a4437999e35b4d86f0e676b3baca8a81
Size: 1.51 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
1.51 MB · 1,508,864 B
First seen
2026-07-11 07:01 · 3 months ago
Last seen
2026-07-11 07:01 · 3 months ago
Last analysis
2026-07-11 07:02 · 3 months ago
Hashes
MD5
a4437999e35b4d86f0e676b3baca8a81
Sha1
4438ff729d980bbea78e69aad315f8c015c7e3be
Sha256
4bb16555c6d16051154f98850757d5eacfefcd07031cdde2054e574f988e8c5b
Sha384
b9a60f6cc46bf7fd20e61842ff41fa5d37f745edaa13c01005aef9cb16d43eb50c8bada6f98803f4693a20a881fddb08
Sha512
0660f3f75a7d4e3657f6e4ae9104f8256458854d65a37f2ff890953cc27f2c9fb7db3aaa6d873d5bd9fc71a429c0dc2a65f0656a3415b30ab25a43c37d0bb4e7
SSDeep
24576:oNB31xX9tIbrZZDI0tHPAcHutnBQsPgIDmdUbeSEBW3uzzZOfOxaEQDo0e:m31xN2ZZ/fOwsZaOeSM8sI3e
TLSH
F2652307ABD1BB1AC19F89386C9798B4015EBC16F806891B33887B5C347F795878B64E
4 malicious · 105 files
OFFa4437999e35b4d86f0e676b3baca8a81T1221
OFF[Repaired @0x0004A200]
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD00129ACB
BINMBD00129ACC
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
XMLstyles.xml
BINmedia
BINtheme
BINworksheets
BINdrawings
BINembeddings
XMLsharedStrings.xml
BINexternalLinks
BIN_rels
OFFexternalLink1.xml.relsT1221
XMLexternalLink1.xml
BINprinterSettings
BINdocProps
BINMBD00129ACD
BIN_VBA_PROJECT_CUR
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.5 |
| CreationDate | D:20260623125600Z |
| Title | Proof Of Payment |
| Producer | OpenPDF 2.0.2 |
| /CreationDate | D:20260623125600Z |
| /Producer | OpenPDF 2.0.2 |
| /Title | Proof Of Payment |
| Version | 1.4 |
| CreationDate | D:20260623205340+08'00' |
| Creator | JasperReports Library version 6.1.0 |
| ModifiedDate | D:20260623205340+08'00' |
| Producer | iText 2.1.7 by 1T3XT |
| /ModDate | D:20260623205340+08'00' |
| /Creator | JasperReports Library version 6.1.0 |
| /CreationDate | D:20260623205340+08'00' |
| /Producer | iText 2.1.7 by 1T3XT |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential