Malicious MS Word Document analysis – d473e5873940

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

8 malicious · 87 files

DOCd473e58739402df3b275bc41bda6cfb5

XML[Content_Types].xml

BIN_rels

BINword

BIN_rels

XMLdocument.xml.rels

XMLfooter2.xml.rels

OFFsettings.xml.rels

XMLdocument.xml

XMLfootnotes.xml

XMLfooter3.xml

XMLfooter2.xml

XMLheader2.xml

XMLendnotes.xml

BINtheme

BINmedia

BINembeddings

XLSMicrosoft_Office_Excel_Worksheet1.xlsx

XML[Content_Types].xml

BIN_rels

BINxl

BIN_rels

XMLworkbook.xml

BINworksheets

XMLstyles.xml

XMLsharedStrings.xml

BINtheme

BINprinterSettings

BINexternalLinks

XMLexternalLink1.xml

BIN_rels

OFFexternalLink1.xml.rels

BINdocProps

OFFMicrosoft_Office_Excel_97-2003_Worksheet1.xls

BINRoot Entry

BINOle

BINEPRINT

BINCompObj

BINObjInfo

OFFWorkbook

OFF[Repaired @0x00036C79]

XML[Content_Types].xml

BIN_rels

BINdrs

BINSummaryInformation

BINDocumentSummaryInformation

OFF[Repaired @0x0003BC79]

XMLsettings.xml

XMLwebSettings.xml

XMLstyles.xml

XMLfontTable.xml

BINdocProps

Config. Field	Value
Target	https:huhuhuhuhuhuhuhuhuhuhu
Path	settihuhuhuhuhuhuhu
XPath	/Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML	<Relathuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
Target	file:/huhuhuhuhuhuhuhuhuhuhu
Path	externhuhuhuhuhuhuhu
XPath	/Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML	<Relathuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Remote Template - Highly Suspicious URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

Remote Template - Highly Suspicious URImalicious

file:/huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential