Malicious
c7c09b4feb5294199a244ff9eb1b8061
MS Office Document
MD5: c7c09b4feb5294199a244ff9eb1b8061
Size: 3.42 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
3.42 MB · 3,424,256 B
Hashes
MD5
c7c09b4feb5294199a244ff9eb1b8061
Sha1
aa4b23cb8c297d2c0e0ed17aa00460f347fb6f31
Sha256
838f3f24867b7ec93a6ad13c225b50f34959e7ed558175f9bc1be2a62337e7b7
Sha384
298bd453758df62390f1ff429bfd0193c11e31df2928922ae8b6bc00f9d0f7a17fd5cc715ec92f4166283584f7ca14d3
Sha512
696f2627f87354a421db64d8baa8da987b3ac980d6c395e09cd3d0b7008e968c4fac4bc9de52c4effbd62ac4a74dc0ebf8320316c6f80b95e1c9fdbea0ab7552
SSDeep
98304:VQDYJx63dnoF/zOa1nnnnnnnnJnnnnnnnnRnnnnnnnnOnnnnnnnnL:VQDYJxsOOa1nnnnnnnnJnnnnnnnnRnnw
TLSH
8CF58E05775E95E8D69F976AFEE09FA830E39C48286250873B4BE54D80D3AD3EC1904F
19 malicious · 45 files
OFFc7c09b4feb5294199a244ff9eb1b8061T1027 · T1059.001
BINRoot Entry
BIN䄦㡥䆾䅤
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
PS1䊬䙑㽫䓙䖑T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
PS1㲩䁼䋝䙳㸈䌥䠱T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1䡀㼿䕷䑬㭪䗤䠤T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䘌䗶䐲䆊䌷䑲
PS1䌋䄱䜵䌾㱪䋹㹝㱳䠶T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䌋䄱䜵㵾㳺䕚㨮㵈㳖䛀
PS1䌋䄱䜵䉾䜒㽡䓫㨹䅘䑬T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 2
STICH kept: 1secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:ps1
malicious
2 nodes
19 malicious · 45 files
OFFc7c09b4feb5294199a244ff9eb1b8061T1027 · T1059.001
BINRoot Entry
BIN䄦㡥䆾䅤
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
PS1䊬䙑㽫䓙䖑T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
PS1㲩䁼䋝䙳㸈䌥䠱T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1䡀㼿䕷䑬㭪䗤䠤T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䘌䗶䐲䆊䌷䑲
PS1䌋䄱䜵䌾㱪䋹㹝㱳䠶T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䌋䄱䜵㵾㳺䕚㨮㵈㳖䛀
PS1䌋䄱䜵䉾䜒㽡䓫㨹䅘䑬T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
No malware configuration was found at this point.
You must be signed in to view YARA rules.