Malicious
b7d79d99cc4c9e1ba512e5a24d3e9708
MS Office Document
MD5: b7d79d99cc4c9e1ba512e5a24d3e9708
Size: 484.35 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
484.35 KB · 484,352 B
First seen
2026-07-02 15:02 · 3 months ago
Last seen
2026-07-02 15:02 · 3 months ago
Last analysis
2026-07-02 17:46 · 3 months ago
Hashes
MD5
b7d79d99cc4c9e1ba512e5a24d3e9708
Sha1
55fc85a65e2b1a668c4be048f1b18fa3996cdf73
Sha256
7fa36027da764a24b5a5978390a536d3608ff7e5272b6c51bfb299b33c5ed094
Sha384
a9df2b6255645c1e7c663cc2cf71cff32d2cdd7f7f2b3c7ed49963a3218583d855c83e7ff4ef064bcbe5b9126720273d
Sha512
b8ee5a30c29f6496e6217808e1bc27540360669c34254b0f0f0ceb7f5b349537d64a6d8689572d907a337f87cd6296c8c3896b58e4c2728390b881a8309d8862
SSDeep
12288:kAPXRC0Yr+79QG0Z3S6793jshEdeUgqG0tAKkvO:kA/El/P3g9EG0tAKkG
TLSH
29A42349B0EECC2EC2679174CFC8C187924AFCB36F85D54BB240B34D883579A575E98A
4 malicious · 71 files
OFFb7d79d99cc4c9e1ba512e5a24d3e9708T1221
OFF[Repaired @0x00000E00]
BINRooT Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD00016040
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
BINworksheets
XMLsheet4.xml
XMLsheet2.xml
XMLsheet3.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet7.xml.rels
XMLsheet6.xml.rels
XMLsheet5.xml.rels
XMLsheet4.xml.rels
XMLsheet1.xml
XMLsheet13.xml
XMLsheet11.xml
XMLsheet10.xml
XMLsheet9.xml
XMLsheet7.xml
XMLsheet6.xml
XMLsheet5.xml
XMLsheet14.xml
XMLsheet15.xml
XMLsheet16.xml
BINmedia
EMFimage1.emf
BINembeddings
OFFoleObject1.bin
BINRoot Entry
BINOle
BINCompObj
PDFCONTENTS
BIN#Stream {UglyToad.PdfPig.Core.XrefLocation}
BINText (Preview)
TXTPage #1
TXTPage #2
TXTPage #3
TXTPage #4
TXTPage #5
TXTPage #6
TXTPage #7
TXTPage #8
TXTPage #9
TXTPage #10
TXTPage #11
TXTStructure
BINdrawings
VMLvmlDrawing1.vml
BIN_rels
XMLvmlDrawing1.vml.rels
XMLsharedStrings.xml
BINtheme
XMLtheme1.xml
XMLstyles.xml
BINprinterSettings
BINprinterSettings4.bin
BINprinterSettings2.bin
BINprinterSettings3.bin
BINprinterSettings1.bin
BINprinterSettings5.bin
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
WMFthumbnail.wmf
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD00016041
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| CONTENTS | 1.7 |
| CONTENTS | Absa Retail |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | DocFusion |
| CONTENTS | D:20260622120032Z |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | Absa Retail |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential4 malicious · 71 files
OFFb7d79d99cc4c9e1ba512e5a24d3e9708T1221
OFF[Repaired @0x00000E00]
BINRooT Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD00016040
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
BINworksheets
BINmedia
BINembeddings
BINdrawings
XMLsharedStrings.xml
BINtheme
XMLstyles.xml
BINprinterSettings
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
BINCompObj
BINMBD00016041
BIN_VBA_PROJECT_CUR
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
b7d79d99cc4c9e1ba512e5a24d3e9708 › RooT Entry › MBD00016040 › Package › xl › externalLinks › _rels › externalLink1.xml.rels
URI
URI
mailtohuhuhuhuhuhuhu
b7d79d99cc4c9e1ba512e5a24d3e9708 › RooT Entry › MBD00016040 › Package › xl › embeddings › oleObject1.bin › Root Entry › CONTENTS
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account