Malicious
MS Office Document
MD5: b508fd25a36975adc1bcf0498b0c2425
Size: 517.12 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
517.12 KB · 517,120 B
Hashes
MD5
b508fd25a36975adc1bcf0498b0c2425
Sha1
db101e6b77805939dc8a099f09663ebcc7bc082d
Sha256
f9a37d5645fb776c96a41d1cd32395d1e4f74adbff10ed0ee917e6abd30a6ba1
Sha384
f5684288412ba799df7405c17511f701d49aca16facbbd3f39ff6d226fec2cb32b322baa65675b0af237cc6110b4b3d5
Sha512
31e3832be4b87226e9e8dc4dcaf45935f31d02728a062c5f0c53d0865da2d6082f1bc354ad33fad17f52fbe052e92d1aaff816cac7cbc520465a722b8087a2e1
SSDeep
12288:+cUilbhhMhhhhhhhhhhhhhMhhhnO0MbKncCT0jFS16YZlriV0HSbNhuYwGYQQqw4:FbibdCAjFczOCybNou3wpC4
TLSH
A0B42304B6A5ED87E223857448E9A987891FFC13BF9AD203FB85732F193FA7216151C4
1 malicious · 59 files
OFFb508fd25a36975adc1bcf0498b0c2425T1204 · T1221CVE-2017-0199
BINRoot Entry
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
10 / 10
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>img>img
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>img>img
malicious
7 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | hTtP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.3 |
| CreationDate | D:20261013195822 |
| Producer | FPDF 1.6 |
| Version | 1.4 |
| Producer | PyPDF4 |
| /Producer | FPDF 1.6 |
| /CreationDate | D:20261013195822 |
| /Producer | PyPDF4 |