Malicious
MS Office Document
MD5: c3b8d6eb74264bbb3763a398e5c9e6bb
Size: 29.7 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
29.7 KB · 29,696 B
First seen
2026-10-07 09:45 · 18 days ago
Last seen
2026-10-07 09:45 · 18 days ago
Last analysis
2026-10-07 09:45 · 18 days ago
Hashes
MD5
c3b8d6eb74264bbb3763a398e5c9e6bb
Sha1
d45cc5f3c3dfd6f169505d2f4ec2b692ef013536
Sha256
3f5a1b0123d0b2b81bf0269c9b9d45c17912679f9da00828292ee7da47333376
Sha384
be676694983e70320cf8efb23df2cb9366b2abbf06a7e0486a450b33ef00fd08eb754fe2602e8069b725268e94d07a17
Sha512
a8607fd23ca3a743f26a4de62e038e96688513a1e04cfc6c60cf72ccac7ac85278a439b81c7ca82bef94e5b0b823959defa8bf922c4372da07806dfc07a8edd2
SSDeep
768:C23ijkJRcEaZ3+ub6qIloeWMbCbGdqTVN/0r:HyjkJI3+NoobIL+
TLSH
EDD26C52B604D332D9034B324A1F97E88B79AC5C9F6320113EEB770C2E729D025FA9E1
61 malicious · 86 files
OFFc3b8d6eb74264bbb3763a398e5c9e6bbT1027 · T1059 · T1059.001
PS1BdAS1L0K2zoQT1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
VBSDhnAzAZH4fOFT1027 · T1059 · T1059.005
VBSDhnAzAZH4fOF.deobfuscated.vbsT1059.005
BINdU1vOudPbUx3
BINRoot Entry
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 3
STICH kept: 2secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:ps1
malicious
2 nodes
Path
ole:doc>scr:vbs~T1027~T1059~T1059.005
Shape
ole:doc>scr:vbs
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential