Malicious
MS Office Document
MD5: b7d79d99cc4c9e1ba512e5a24d3e9708
Size: 484.35 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
484.35 KB · 484,352 B
First seen
2026-07-02 15:02 · 3 months ago
Last seen
2026-07-02 15:02 · 3 months ago
Last analysis
2026-07-02 17:46 · 3 months ago
Hashes
MD5
b7d79d99cc4c9e1ba512e5a24d3e9708
Sha1
55fc85a65e2b1a668c4be048f1b18fa3996cdf73
Sha256
7fa36027da764a24b5a5978390a536d3608ff7e5272b6c51bfb299b33c5ed094
Sha384
a9df2b6255645c1e7c663cc2cf71cff32d2cdd7f7f2b3c7ed49963a3218583d855c83e7ff4ef064bcbe5b9126720273d
Sha512
b8ee5a30c29f6496e6217808e1bc27540360669c34254b0f0f0ceb7f5b349537d64a6d8689572d907a337f87cd6296c8c3896b58e4c2728390b881a8309d8862
SSDeep
12288:kAPXRC0Yr+79QG0Z3S6793jshEdeUgqG0tAKkvO:kA/El/P3g9EG0tAKkG
TLSH
29A42349B0EECC2EC2679174CFC8C187924AFCB36F85D54BB240B34D883579A575E98A
4 malicious · 71 files
OFFb7d79d99cc4c9e1ba512e5a24d3e9708T1221
OFF[Repaired @0x00000E00]
BINRooT Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD00016040
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
BINworksheets
BINmedia
BINembeddings
BINdrawings
XMLsharedStrings.xml
BINtheme
XMLstyles.xml
BINprinterSettings
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
BINCompObj
BINMBD00016041
BIN_VBA_PROJECT_CUR
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| CONTENTS | 1.7 |
| CONTENTS | Absa Retail |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | DocFusion |
| CONTENTS | D:20260622120032Z |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | Absa Retail |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential