Malicious
c85ac385953fc8b8881e60dec7666640
MS Office Document
MD5: c85ac385953fc8b8881e60dec7666640
Size: 620.54 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
620.54 KB · 620,544 B
First seen
2026-09-29 07:15 · 26 days ago
Last seen
2026-09-29 07:15 · 26 days ago
Last analysis
2026-09-29 07:15 · 26 days ago
Hashes
MD5
c85ac385953fc8b8881e60dec7666640
Sha1
94d1d8a06e09691dfd45b1c459a3f83ddc9110cb
Sha256
ce61e53d5168643763383fae41d272abf5f756fa47a21af75393c6d1615575de
Sha384
1b7f9d18d60c309d42cc18502689c295cf0f87463c42ded1e9de772aee1418e28cabb6947f0e6450129cd71a04e171e0
Sha512
578cd8695fa63fcafd80e0532f0b7f2324295203fd3c82cdfaaf5c2b798511e55dec9219c60ef71014132f113da16d614041106bb303d2a6fded26dcba3066b1
SSDeep
12288:jw00000000000S02tGboHUqef8Pelb2drgF4s7SzE8pASwNHe4ahDfCq3i:jxoZnrgTh8Ue4ADd
TLSH
BDD4232472C8C9A3DBD39A78C7C552A6E529FE42DF43C36F7A14731F0632791A5A201E
1 malicious · 58 files
OFFc85ac385953fc8b8881e60dec7666640T1204 · T1221CVE-2017-0199
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD00029381
XLSPackage
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
XMLsharedStrings.xml
XMLstyles.xml
BINtheme
XMLtheme1.xml
BINworksheets
BIN_rels
XMLsheet1.xml.rels
XMLsheet1.xml
BINdrawings
BIN_rels
XMLvmlDrawing1.vml.rels
VMLvmlDrawing1.vml
BINmedia
EMFimage2.emf
EMFimage1.emf
BINembeddings
OFFoleObject2.bin
BINRoot Entry
BINOle
BINCompObj
PDFCONTENTS
BINText (Preview)
TXTPage #1
BIN#Stream obj 6 0
IMG#Stream obj 5 0
IMG#Stream obj 5 0-preview.png
BIN#Stream obj 279 0
BIN#Stream obj 282 0
BIN#Stream obj 283 0
BIN#Stream obj 286 0
BIN#Stream obj 287 0
BIN#Stream obj 290 0
BIN#Stream obj 291 0
BIN#Stream obj 294 0
BIN#Stream obj 10 0
OFFoleObject1.bin
BINRoot Entry
PDFOle10Native
PDFPDF @0x000000E0
BINText (Preview)
TXTPage #1
BIN#Stream obj 13 0
BIN#Stream obj 12 0
BIN#Stream obj 21 0
BIN#Stream obj 22 0
BIN#Stream obj 23 0
BIN#Stream obj 24 0
BIN#Stream obj 5 0
TXTStructure
BINprinterSettings
BINprinterSettings1.bin
BINdocProps
WMFthumbnail.wmf
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD00029382
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
11 / 11
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>img
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>img
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.3 |
| Author | dipak |
| CreationDate | D:20260905130956+05'30' |
| Creator | PScript5.dll Version 5.2.2 |
| ModifiedDate | D:20260905130956+05'30' |
| Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| Producer | GPL Ghostscript 9.06 |
| /Producer | GPL Ghostscript 9.06 |
| /CreationDate | D:20260905130956+05'30' |
| /ModDate | D:20260905130956+05'30' |
| /Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| /Creator | PScript5.dll Version 5.2.2 |
| /Author | dipak |
| Version | 1.4 |
| CreationDate | D:20260910044932+00'00' |
| Creator | |
| ModifiedDate | D:20260910044932+00'00' |
| Title | SLES CALIBRATION PRIVATE LIMITED |
| Producer | Skia/PDF m152 |
| /Title | SLES CALIBRATION PRIVATE LIMITED |
| /Creator | |
| /Producer | Skia/PDF m152 |
| /CreationDate | D:20260910044932+00'00' |
| /ModDate | D:20260910044932+00'00' |
| Version | 1.3 |
| Author | dipak |
| CreationDate | D:20260905130956+05'30' |
| Creator | PScript5.dll Version 5.2.2 |
| ModifiedDate | D:20260905130956+05'30' |
| Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| Producer | GPL Ghostscript 9.06 |
| /Producer | GPL Ghostscript 9.06 |
| /CreationDate | D:20260905130956+05'30' |
| /ModDate | D:20260905130956+05'30' |
| /Title | Crystal Reports ActiveX Designer - PI_BILLC1.RPT |
| /Creator | PScript5.dll Version 5.2.2 |
| /Author | dipak |
1 malicious · 58 files
OFFc85ac385953fc8b8881e60dec7666640T1204 · T1221CVE-2017-0199
BINRoot Entry
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account