Malicious
e2a73c72e2f8796e783838254af44723
MS Office Document
MD5: e2a73c72e2f8796e783838254af44723
Size: 4.7 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
4.7 MB · 4,700,160 B
Hashes
MD5
e2a73c72e2f8796e783838254af44723
Sha1
b97096159eb1c2ddf660a2ebef625a61c794588f
Sha256
1212bfc031aa5dac0e236a57d591c7c36d6847a3596c6e150b7e0899d4e92a5d
Sha384
be344d101860ea47ce1a859c362f882695b781809d83eb91b8513a9236f392cdf2a93b95312a6ac41dee24104f5e85e9
Sha512
cf5ba43111f0d4f96bde97c57967ec190a7534a56a74621c959f3dfd9cc72aa221ea71fc9df93cb18f95f2dd4324ae8dd6933b202494f57c8794a1b52e7b9bae
SSDeep
49152:cz1izUT1bXONold1ggxkhoJ9QRMPmdRSbnLcpk12T0gV6QbXByh:esU5bXONor5aQ7ud6Lm02wgQQQh
TLSH
C6265BB93F81C294ECA62E1B0812CADF03297C29EDCE437265F9745E25D5D9E0364DAC
19 malicious · 45 files
OFFe2a73c72e2f8796e783838254af44723T1027 · T1059.001
BINRoot Entry
BIN䄦㡥䆾䅤
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
PS1㦨䈅䃶㶺䚺㿎T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1䇐㰱㵛䜕㥀㨳T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
PS1䡀㼿䕷䑬㭪䗤䠤T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䌋䄱䜵㶾㳩㱭㴠㾇䚑
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
PS1䌋䄱䜵㰾䑧㻐㵕㠼䓅䠈T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1䌋䄱䜵䈾㥆䖨䚣䚖㮺䠟T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 2
STICH kept: 1secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:ps1
malicious
2 nodes
19 malicious · 45 files
OFFe2a73c72e2f8796e783838254af44723T1027 · T1059.001
BINRoot Entry
BIN䄦㡥䆾䅤
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
PS1㦨䈅䃶㶺䚺㿎T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1䇐㰱㵛䜕㥀㨳T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
PS1䡀㼿䕷䑬㭪䗤䠤T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䌋䄱䜵㶾㳩㱭㴠㾇䚑
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
PS1䌋䄱䜵㰾䑧㻐㵕㠼䓅䠈T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1䌋䄱䜵䈾㥆䖨䚣䚖㮺䠟T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
No malware configuration was found at this point.
You must be signed in to view YARA rules.