Malicious
MS Office Document
MD5: b157cc8493fe006bccefaca83a353311
Size: 17.16 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
17.16 MB · 17,162,240 B
First seen
2025-12-21 22:01 · 10 months ago
Last seen
2025-12-21 22:01 · 10 months ago
Last analysis
2025-12-21 22:15 · 10 months ago
Hashes
MD5
b157cc8493fe006bccefaca83a353311
Sha1
aad3a95d8c73a6107226b859d829bbaf95983f79
Sha256
3f650e17436767520c57a268135de7a4912f340b895650ed505325047cf08268
Sha384
839fdd8687d7addaff36afa408c8c82b617c47da88c2874323c4ce7f399e881b6caab1b4b1af1d6e5f739bb7c2baf4e1
Sha512
7bb0eeac6a8d9fd538637bf7d7ff602ed20d8af773eda882eaa044deecc2fc751ca5ca4664bfc00aa6cb7f0ee027251ff7bbd53a5a2f98745a00d1d24fe11373
SSDeep
393216:GHX2K5qWIVORi1se3sJhHGAk0n0COLpuyThNDy9:GHPkSi1se8DGX00COLpRND
TLSH
EB0733D29B8DFFB7E1BE8435A5FAC6911545ED202320C88BB7683E5428322F3B359715
3 malicious · 1488 files
OFFb157cc8493fe006bccefaca83a353311
BINRoot Entry
PYcerts.py
DLLClosedXML.dll
DLLDocumentFormat.OpenXml.dll
RTFEULA.rtf
DLLExcelNumberFormat.dll
DLLFastMember.dll
DLLFastMember.Signed.dll
DLLlibcrypto-3.dll
DLLlibffi-8.dll
DLLlibssl-3.dll
TXTLICENSE.txt
PS1lnk.ps1
PS1[Deobfuscated PS]
BINlog4net.config
DLLlog4net.dll
DLLMicrosoft.ApplicationInsights.dll
DLLNewtonsoft.Json.dll
EXEpyexpat.pyd
CATpython.cat
EXEpython.exe
DLLpython3.dll
DLLpython313.dll
ZIPpython313.zip
_PTHpython313._pth
EXEpythonw.exe
EXERVTools.exe
BINRVTools.exe.config
PDFRVTools.pdf
ICOrvtools32x32.ico
PS1RVToolsBatchMultipleVCs.ps1
PS1RVToolsCreateLocalUser.ps1
PS1RVToolsFindBadVM.ps1
EXERVToolsMergeExcelFiles.exe
BINRVToolsMergeExcelFiles.exe.config
PS1RVToolsPasswordEncryption.ps1
EXERVToolsSendMail.exe
BINRVToolsSendMail.exe.config
EXEselect.pyd
DLLsqlite3.dll
DLLSTSService.dll
DLLSystem.Buffers.dll
DLLSystem.Diagnostics.DiagnosticSource.dll
DLLSystem.IO.FileSystem.Primitives.dll
DLLSystem.Memory.dll
DLLSystem.Net.Http.dll
DLLSystem.Numerics.Vectors.dll
DLLSystem.Runtime.CompilerServices.Unsafe.dll
DLLtcl86t.dll
DLLtk86t.dll
EXEunicodedata.pyd
DLLvcruntime140.dll
DLLvcruntime140_1.dll
DLLVim25Service.dll
DLLVMware.Binding.WsTrust.dll
EXEwinsound.pyd
DLLzlib1.dll
EXE_asyncio.pyd
EXE_bz2.pyd
EXE_ctypes.pyd
EXE_decimal.pyd
EXE_elementtree.pyd
EXE_hashlib.pyd
EXE_lzma.pyd
EXE_multiprocessing.pyd
EXE_overlapped.pyd
EXE_queue.pyd
EXE_socket.pyd
EXE_sqlite3.pyd
EXE_ssl.pyd
EXE_uuid.pyd
EXE_wmi.pyd
EXE_zoneinfo.pyd
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| RVTools.pdf | 1.7 |
| RVTools.pdf | Rob de Veij |
| RVTools.pdf | D:20240930143555+01'00' |
| RVTools.pdf | Microsoft® Word for Microsoft 365 |
| RVTools.pdf | D:20240930143555+01'00' |
| RVTools.pdf | RVTools 4.7.1 October 3, 2024 |
| RVTools.pdf | Microsoft® Word for Microsoft 365 |
| RVTools.pdf | true |
| RVTools.pdf | 2023-10-13T16:49:30Z |
| RVTools.pdf | Privileged |
| RVTools.pdf | Public No Visual Label |
| RVTools.pdf | 945c199a-83a2-4e80-9f8c-5a91be5752dd |
| RVTools.pdf | 99a04929-6196-4e8e-ba9f-4d322af4fd51 |
| RVTools.pdf | 0 |
| RVTools.pdf | RVTools 4.7.1 October 3, 2024 |
| RVTools.pdf | Rob de Veij |
| RVTools.pdf | Microsoft® Word for Microsoft 365 |
| RVTools.pdf | D:20240930143555+01'00' |
| RVTools.pdf | D:20240930143555+01'00' |
| RVTools.pdf | Microsoft® Word for Microsoft 365 |
Deobfuscated PowerShell
UNKNWOWNmalicious
$currehuhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #9
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #10
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #11
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #12
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #13
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #14
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #15
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #16
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #17
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential