Malicious
b508fd25a36975adc1bcf0498b0c2425
MS Office Document
MD5: b508fd25a36975adc1bcf0498b0c2425
Size: 517.12 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
517.12 KB · 517,120 B
Hashes
MD5
b508fd25a36975adc1bcf0498b0c2425
Sha1
db101e6b77805939dc8a099f09663ebcc7bc082d
Sha256
f9a37d5645fb776c96a41d1cd32395d1e4f74adbff10ed0ee917e6abd30a6ba1
Sha384
f5684288412ba799df7405c17511f701d49aca16facbbd3f39ff6d226fec2cb32b322baa65675b0af237cc6110b4b3d5
Sha512
31e3832be4b87226e9e8dc4dcaf45935f31d02728a062c5f0c53d0865da2d6082f1bc354ad33fad17f52fbe052e92d1aaff816cac7cbc520465a722b8087a2e1
SSDeep
12288:+cUilbhhMhhhhhhhhhhhhhMhhhnO0MbKncCT0jFS16YZlriV0HSbNhuYwGYQQqw4:FbibdCAjFczOCybNou3wpC4
TLSH
A0B42304B6A5ED87E223857448E9A987891FFC13BF9AD203FB85732F193FA7216151C4
1 malicious · 59 files
OFFb508fd25a36975adc1bcf0498b0c2425T1204 · T1221CVE-2017-0199
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD000C2AB0
XLSPackage
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
BINtheme
XMLtheme1.xml
BINworksheets
XMLsheet3.xml
XMLsheet2.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet1.xml
BINdrawings
BIN_rels
XMLvmlDrawing1.vml.rels
VMLvmlDrawing1.vml
BINmedia
EMFimage2.emf
EMFimage1.emf
BINembeddings
OFFoleObject2.bin
BINRoot Entry
BINOle
BINCompObj
PDFCONTENTS
BINText (Preview)
TXTPage #1
BIN#Stream obj 5 0
BIN#Stream obj 13 0
BIN#Stream obj 12 0
IMG#Stream obj 14 0
EXIF#Stream obj 14 0.exif
IMG#Stream obj 14 0-preview.png
BIN#Stream obj 4 0
TXTStructure
OFFoleObject1.bin
BINRoot Entry
PDFCONTENTS
BINText (Preview)
TXTPage #1
BIN#Stream obj 5 0
BIN#Stream obj 7 0
BIN#Stream obj 13 0
BIN#Stream obj 14 0
BIN#Stream obj 17 0
BIN#Stream obj 18 0
BIN#Stream obj 21 0
BIN#Stream obj 24 0
BIN#Stream obj 27 0
BIN#Stream obj 29 0
BIN#Stream obj 31 0
XMLstyles.xml
XMLsharedStrings.xml
BINprinterSettings
BINprinterSettings1.bin
BINprinterSettings2.bin
BINdocProps
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD000C2AB1
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
10 / 10
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>img>img
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>img>img
malicious
7 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | hTtP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.3 |
| CreationDate | D:20261013195822 |
| Producer | FPDF 1.6 |
| Version | 1.4 |
| Producer | PyPDF4 |
| /Producer | FPDF 1.6 |
| /CreationDate | D:20261013195822 |
| /Producer | PyPDF4 |
1 malicious · 59 files
OFFb508fd25a36975adc1bcf0498b0c2425T1204 · T1221CVE-2017-0199
BINRoot Entry
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | hTtP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
You must be signed in to view YARA rules.