Malicious
aa676850d9bbad6ee9cac3e4e536c157
MS Office Document
MD5: aa676850d9bbad6ee9cac3e4e536c157
Size: 100.35 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
100.35 KB · 100,352 B
First seen
2026-10-09 13:00 · 16 days ago
Last seen
2026-10-09 13:00 · 16 days ago
Last analysis
2026-10-09 13:00 · 16 days ago
Hashes
MD5
aa676850d9bbad6ee9cac3e4e536c157
Sha1
1b2fde2fd50128af75699d076f056b9260df1b5d
Sha256
c42603abe0ecb4257393e0412fad62b7ee29c362a09bce3161d9d1146fab23b3
Sha384
792fec76da1191217cb5601ced801670326bf5c2c9315c5e80595666f7465e44eec6bd59a175abface1d732d7f84671a
Sha512
6b2cca25d37521cb686c96aa35409af82bea17bfc2d65393dff22d3f8e610a55e4a470d1f604e85ad07a25add2f2a11c1f23754cf3130fe383d94732828ed804
SSDeep
1536:e9GRDGH87zMOZYnyRnLbFEHCxg6T2toKjnhNIBPZUlEeq3cykLj5UKLIK:bKjOZwCLb6ixn1KjnnIBP2tykn5
TLSH
61A3E024B1A0D849EB141D3D8EC6D1DB0A187CA9AF07821B3740FF1C553F5E6CEA6A39
1 malicious · 32 files
OFFaa676850d9bbad6ee9cac3e4e536c157T1204 · T1221CVE-2017-0199
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD01BDF16E
XLSPackage
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
XMLstyles.xml
BINworksheets
XMLsheet2.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet1.xml
BINdrawings
BIN_rels
XMLdrawing1.xml.rels
XMLdrawing2.xml
XMLdrawing1.xml
BINtheme
XMLtheme1.xml
XMLsharedStrings.xml
BINmedia
EMFimage1.emf
BINprinterSettings
BINprinterSettings1.bin
BINprinterSettings2.bin
BINdocProps
WMFthumbnail.wmf
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD01BDF16F
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
7 / 7
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>bin
Shape
ole:doc>oox:xlsx>oox:media>bin
malicious
4 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>bin
Shape
ole:doc>oox:xlsx>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | httP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential1 malicious · 32 files
OFFaa676850d9bbad6ee9cac3e4e536c157T1204 · T1221CVE-2017-0199
BINRoot Entry
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | httP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account