Malicious
ce9ce3395ca1e410b7949d9160b8905c
MS Word Document
MD5: ce9ce3395ca1e410b7949d9160b8905c
Size: 37.83 KB
application/msword
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | ce9ce3395ca1e410b7949d9160b8905c |
| Sha1 | 214f8a07827b6c51e1922f1a94735ea0633c6c53 |
| Sha256 | e3fbe466054844db78527a099d11a4e9d12c40a4bd9add4bef9faea10a902eae |
| Sha384 | b9a18ea3d5425d0f12f31d52f876d108e795d29d89db4491a01cb7737a4a2abddfa151f70506f89a6128f1e63f69d134 |
| Sha512 | a900b58cf0e2a35cc93db27ad25b63e6d5a279da0c84af64156d66e97c4850844d50617e9e2d10b9d2b351ab77efe684ccf198e0034a1dd66e75880844d5cb68 |
| SSDeep | 768:ZAWFnm7rdW8Rhej2aCRWrY/CGD5uLiNTKUU2vqYfoZ4C:Lm7rZHIwr/CGD5uLmdU2iB |
| TLSH | 0003E025CD275071E0B7BA32EE1E4D90F2594B54C1D17B7B382F829990B3B4EED5B205 |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 6
STICH kept: 1secondary ignored: 5
img
1oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
oox:docx>oox:rel:ext~T1221
Shape
oox:docx>oox:rel:ext
technique2 nodes
| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | settihuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Remote Template - Highly Suspicious
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | settihuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Remote Template - Highly Suspicious
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
ce9ce3395ca1e410b7949d9160b8905c › word › _rels › settings.xml.rels
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.