Malicious
bc96a06b494b9ed91a2f91196f1ebb0b
MS Office Document
MD5: bc96a06b494b9ed91a2f91196f1ebb0b
Size: 208.9 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | bc96a06b494b9ed91a2f91196f1ebb0b |
| Sha1 | e3d68f3e9a40d095408c96d06354eb79ae167430 |
| Sha256 | 6455249da2bd46ae134f9d1fb373b7d11bd561ee045e8741315c1109a7f30587 |
| Sha384 | 386ba1eba03f95ee8b2a9b25134494a7d469a98a401086db1cb30dd1943138df85a236fa46fdaa9c0c02d238524b7eea |
| Sha512 | b1db0e3f4939e7ee8366ccf22cafbd9584f266d5fd5047b32f7798c9acef13d0c24a1367e3d2dcb01c0155e00120113adac678b2e4a4b8553b8c5dfe68919a43 |
| SSDeep | 6144:gOTAJXB5+e3ZGSilZbeBcVdU9eMR3QQjy/avpaVw:hqGbaBQU913z1v8 |
| TLSH | A51412AC33A6C647D473687EDDE9C2C79151FC118D42AB0F3399B38F6674A90860B74A |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
10 / 10
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf>pdf:stream>bin
malicious
7 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | HttP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.4 |
| CreationDate | D:20220603065428-04'00' |
| Creator | Apache FOP Version 1.0 |
| Producer | Apache FOP Version 1.0 |
| /Creator | Apache FOP Version 1.0 |
| /Producer | Apache FOP Version 1.0 |
| /CreationDate | D:20220603065428-04'00' |
| Version | 1.4 |
| CreationDate | D:20220603065428-04'00' |
| Creator | Apache FOP Version 1.0 |
| Producer | Apache FOP Version 1.0 |
| /Creator | Apache FOP Version 1.0 |
| /Producer | Apache FOP Version 1.0 |
| /CreationDate | D:20220603065428-04'00' |
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | HttP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
You must be signed in to view YARA rules.