Malicious
b595c817cafa95df2847ea33ff9fa318
MS Office Document
MD5: b595c817cafa95df2847ea33ff9fa318
Size: 331.26 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | b595c817cafa95df2847ea33ff9fa318 |
| Sha1 | 1c76d1f84697f4023bb3b1f7c2e3979b949cafad |
| Sha256 | a0e706220fedfbd48bcec6140fc32f713eac058e74d7bccc9effb971e9e320ea |
| Sha384 | d70aaddedef1e4531fbb5a56d9e5c8040f8471813fe13ef1be46ba6624a0465825c776308923e4c33abe9bb1a2b0bfe8 |
| Sha512 | a1b612d700549228cd502dc9dc2536d7f6d149cb07ce049c34d3f67d928a2c65bb058fc4b65a3d3792b93b5397edf86432a18216ea5013d91140d8fd643662aa |
| SSDeep | 6144:p/0kEnfcO/W4+jHs9ExQ51ZGSilZbeBcVdU9eMR3QQ/kgjWwsB:W0OOtjyJGbaBQU913z1jWzB |
| TLSH | 0F6412E832D5C35BD867A939DDE8C0CF9226FC205D66870B37D673AD76B92C09502386 |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
12 / 12
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf>pdf:stream>bin
malicious
7 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | HTtp:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.4 |
| CreationDate | D:20260910044932+00'00' |
| Creator | |
| ModifiedDate | D:20260910044932+00'00' |
| Title | SLES CALIBRATION PRIVATE LIMITED |
| Producer | Skia/PDF m152 |
| /Title | SLES CALIBRATION PRIVATE LIMITED |
| /Creator | |
| /Producer | Skia/PDF m152 |
| /CreationDate | D:20260910044932+00'00' |
| /ModDate | D:20260910044932+00'00' |
| Version | 1.4 |
| CreationDate | D:20260910044932+00'00' |
| Creator | |
| ModifiedDate | D:20260910044932+00'00' |
| Title | SLES CALIBRATION PRIVATE LIMITED |
| Producer | Skia/PDF m152 |
| /Title | SLES CALIBRATION PRIVATE LIMITED |
| /Creator | |
| /Producer | Skia/PDF m152 |
| /CreationDate | D:20260910044932+00'00' |
| /ModDate | D:20260910044932+00'00' |
| Version | 1.4 |
| CreationDate | D:20220603065428-04'00' |
| Creator | Apache FOP Version 1.0 |
| Producer | Apache FOP Version 1.0 |
| /Creator | Apache FOP Version 1.0 |
| /Producer | Apache FOP Version 1.0 |
| /CreationDate | D:20220603065428-04'00' |
| Version | 1.4 |
| CreationDate | D:20220603065428-04'00' |
| Creator | Apache FOP Version 1.0 |
| Producer | Apache FOP Version 1.0 |
| /Creator | Apache FOP Version 1.0 |
| /Producer | Apache FOP Version 1.0 |
| /CreationDate | D:20220603065428-04'00' |
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | HTtp:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
You must be signed in to view YARA rules.