Malicious
Malicious

e0951aff3ee0cd166e76c04f68d34469

MS Word Document
MD5: e0951aff3ee0cd166e76c04f68d34469
Size: 1.28 MB
application/msword
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e0951aff3ee0cd166e76c04f68d34469
Sha1 0d93b6262fcc32126cba2530d66624e6fb3c100d
Sha256 9e1c3817c2b4f5aff5b8ed5288fca53df1ad392022c2fa3b609e0103ec2ae08e
Sha384 26ef295a6b24f0d2df49211f13f4c09eae2217faae4d3f263df9227979f9ff58e0735358c32e7a205de690a05a294b1c
Sha512 e3b09d01a692fce4dfcc24d4359a72ad215f237f91dac94dcd1ddecf0129cd909976241631c59c21b7444e7de8ab9ff244d617ed21f7f3f7f512369dd3391f7e
SSDeep 24576:QFZ0H1J8zzbjSzPhrIpurNfsr7JvRDEE9CE4BeL+d8CtdIOFzSX:e2J8DjSzBIpnrFp4ICEseLWDq+m
TLSH 3C45121399468F93DA6CC7F87F470E6C9F06272CE09539EF05661C9B7B692220C8E16D
[Content_Types].xml
_rels
.rels
word
document.xml
_rels
document.xml.rels
vbaProject.bin.rels
media
image1.jpg
image1.jpg-preview.png
theme
theme1.xml
vbaData.xml
settings.xml
styles.xml
webSettings.xml
fontTable.xml
docProps
core.xml
app.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
9 / 9
Path oox:docm~T1059.005>oox:media>img
Shape oox:docm>oox:media>img
technique3 nodes
Path oox:docm~T1059.005>bin
Shape oox:docm>bin
technique2 nodes
[Content_Types].xml
_rels
.rels
word
document.xml
_rels
document.xml.rels
vbaProject.bin.rels
media
image1.jpg
image1.jpg-preview.png
theme
theme1.xml
vbaData.xml
settings.xml
styles.xml
webSettings.xml
fontTable.xml
docProps
core.xml
app.xml

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
ThisDocument
Blacklist VBA
VBA Macro
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙