Malicious
Malicious

bdccba336a6598f3e115d1ce4f811ffc

Share on LinkedIn
Print
MS Office Document
MD5: bdccba336a6598f3e115d1ce4f811ffc
Size: 2.27 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 bdccba336a6598f3e115d1ce4f811ffc
Sha1 373a5fabcbcc3fb23b5851ede16af58837ada549
Sha256 102ff00783835908864134df26af899aaee2846f4d46fa17d9c1bf5934a3f0d3
Sha384 5ac687af48a333512cb33cfff33b11395b11137d2b5b87c09de64359912f88431b9643dfb35fbb0dfa497bd8b55fb56c
Sha512 3d8063755c371da0e5db3b712ebf777821c9562a88f389b82f6194aa3927f53216cb7385c1c99af071b3b8c6b60f57fb9fd018e126f2df99a7f11623fdf1128d
SSDeep 24576:KDcs+zkuBYCbM6UEVfofhGVo59FqYGauw4o4Y01qZtLoNmwlM:Kn8YQuF8VozA3rqZ5oLe
TLSH A1B54C636A50600542B5A8FABEBD5E37694F3409102AD98EFFD31B86F52E6F44C02D1F
Root Entry
Malicious
䡀䈖䌧䠤
䡀䌋䄱䜵
䡀㬿䏲䐸䖱
䡀㽿䅤䈯䠶
䡀䈏䗤䕸䠨
䡀䈛䌪䗶䜵
䡀䕙䓲䕨䜷
䡀䌍䈵䗦䕲䠼
䡀䒌䓰䑲䑨䠷
䡀㼿䕷䑬㹪䒲䠯
䡀䘌䗶䐲䆊䌷䑲
䌋䄱䜵䉾㦴䀷䜰㽯
Malicious
䡀䇊䌰㾱㼒䔨䈸䆱䠨
䌋䄱䜵䄾䁜䙕䖦䎤䂤䠐
䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
SummaryInformation
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path ole:doc>scr:ps1~T1027~T1059.001
Shape ole:doc>scr:ps1
malicious 2 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙