Malicious
MS Office Document
MD5: c7025f4b92aeabdffe3524b98a38935b
Size: 920.58 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
920.58 KB · 920,576 B
First seen
2026-08-06 14:31 · 2 months ago
Last seen
2026-08-06 14:31 · 2 months ago
Last analysis
2026-08-06 17:09 · 2 months ago
Hashes
MD5
c7025f4b92aeabdffe3524b98a38935b
Sha1
a4af807f8d4a056b89f1b865f6ac6366d4be3e73
Sha256
ff2ca63ce0afe23545e57623af69aa39055f089501cfa524217588b2b7c06292
Sha384
b19fa8d1abc33222fc032cd1514586f8224c56cc90ba090a39ac4b7bd5e6c7a5e814d72e800b4c5cffd8f919ca67ba32
Sha512
a0e6a0f2bc53aeb055b1cffe8d3894c92589dcf83c197bc8c3026ca8794a6d3ad2ad11887cb79b2da447828ff4681cd9f16871780c9e36e05bdbc5f440fb23c5
SSDeep
24576:JKNt1QRT/64rmfu1UiVN4jtE9BmLf27XmEqq:JKNtmB6Bu19v4xE9By27Nq
TLSH
BA151212FE808937CD5257380F53A2D1E21DBC6B9E6A9B0B1785337E783B6E4D952C06
3 malicious · 81 files
OFFc7025f4b92aeabdffe3524b98a38935bT1221
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD00370451
BINMBD00370452
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
XMLstyles.xml
BINdrawings
BINworksheets
BINtheme
BINmedia
XMLsharedStrings.xml
BINembeddings
BINprinterSettings
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
BINCompObj
BINMBD00370453
BIN_VBA_PROJECT_CUR
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 12
STICH kept: 2secondary ignored: 10
bin
5img
1oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>oox:xlsx>oox:rel:ext~T1221
Shape
ole:doc>oox:xlsx>oox:rel:ext
technique3 nodes
Path
ole:doc>oox:xlsx>oox:media>ole:doc
Shape
ole:doc>oox:xlsx>oox:media>ole:doc
4 nodes
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #3 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.7 |
| CreationDate | D:20260731145050-04'00 |
| Creator | Mozilla Firefox 153.0.1 |
| Producer | cairo 1.18.4 (https://cairographics.org) |
| /Producer | cairo 1.18.4 (https://cairographics.org) |
| /Creator | Mozilla Firefox 153.0.1 |
| /CreationDate | D:20260731145050-04'00 |
| Version | 1.6 |
| Producer | Oracle BI Publisher 12.2.1.4.0 |
| /Producer | Oracle BI Publisher 12.2.1.4.0 |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential