Malicious
MS Office Document
MD5: b4998675ca07f9e938b2b42c91eab8c7
Size: 620.54 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
620.54 KB · 620,544 B
First seen
2026-09-29 07:30 · 26 days ago
Last seen
2026-09-29 07:30 · 26 days ago
Last analysis
2026-09-29 07:30 · 26 days ago
Hashes
MD5
b4998675ca07f9e938b2b42c91eab8c7
Sha1
c28ce244fadbc4c2b963f52cc06e60181b1cf528
Sha256
f0b910c4acd7ead9d966492c21302d51c2a68c2af552683250fa9d1707db29f6
Sha384
f45d321a08d983e2284a79e1cbbe32f719fbb457b40c79460d80157a60cc836bb39dfdb23942bb965a480b49a4144dc9
Sha512
5e869031fcd79a8f7ee62cec78fef2ed95e1a14a08aad9bd4564e09bd81d64505f84f6539bd2ce5c820bd2d5001a4a349fc49f6d3731327c3e493275d8ee463b
SSDeep
12288:Dw00000000000S02tGboHmjelzeIwHmuesqvqDyn5pPpjnxpC6:DxogTP3yTM6
TLSH
1AD42305B2E4CEA6E7E3D6788BC69186A938BC05DB46DB2F7908B30F08337225573355
1 malicious · 58 files
OFFb4998675ca07f9e938b2b42c91eab8c7T1204 · T1221CVE-2017-0199
BINRoot Entry
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
11 / 11
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf>pdf:stream>bin
malicious
7 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.4 |
| CreationDate | D:20260910044932+00'00' |
| Creator | |
| ModifiedDate | D:20260910044932+00'00' |
| Title | SLES CALIBRATION PRIVATE LIMITED |
| Producer | Skia/PDF m152 |
| /Title | SLES CALIBRATION PRIVATE LIMITED |
| /Creator | |
| /Producer | Skia/PDF m152 |
| /CreationDate | D:20260910044932+00'00' |
| /ModDate | D:20260910044932+00'00' |
| Version | 1.3 |
| Author | dipak |
| CreationDate | D:20260905130956+05'30' |
| Creator | PScript5.dll Version 5.2.2 |
| ModifiedDate | D:20260905130956+05'30' |
| Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| Producer | GPL Ghostscript 9.06 |
| /Producer | GPL Ghostscript 9.06 |
| /CreationDate | D:20260905130956+05'30' |
| /ModDate | D:20260905130956+05'30' |
| /Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| /Creator | PScript5.dll Version 5.2.2 |
| /Author | dipak |
| Version | 1.3 |
| Author | dipak |
| CreationDate | D:20260905130956+05'30' |
| Creator | PScript5.dll Version 5.2.2 |
| ModifiedDate | D:20260905130956+05'30' |
| Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| Producer | GPL Ghostscript 9.06 |
| /Producer | GPL Ghostscript 9.06 |
| /CreationDate | D:20260905130956+05'30' |
| /ModDate | D:20260905130956+05'30' |
| /Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| /Creator | PScript5.dll Version 5.2.2 |
| /Author | dipak |