Malicious
e4b4825457c636ce7de43b8753722e36
MS Office Document
MD5: e4b4825457c636ce7de43b8753722e36
Size: 667.14 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
667.14 KB · 667,136 B
Hashes
MD5
e4b4825457c636ce7de43b8753722e36
Sha1
a1b9d2b70d3e584ef5f5a7d4b2708fa97ad0eaa0
Sha256
644f3e35c4d8c72c569597dcd7c6530e1af7d397d97f584ba5596df5a8c5742a
Sha384
74b6553b3ae3cdf18fd592aad43eb946b538d23d669b7959ee094bcd09cce0e1fcc608dffbbc067e63cb5588468147ee
Sha512
3d1e0d053d8581b28430c0bb4c4a21917b5ec9b1a0ff401edbd0a3d77398f40950f06dc8609a8fe247020880eafd0423543221b3e9482b097851846a287d80af
SSDeep
12288:UvhhJYtOsGbNNN2bBpvUEV/LCivEKUV//0Kihucv7SrLzOd2uJ6eYCfhQvHHd9QC:UvhktjGKrrRZUV30Kiscv7Y6t6VvH0o
TLSH
28E41210B190BA37C7FE25B2399265D545BDFC26CE02E957294033FD3E72BB1882626D
1 malicious · 60 files
OFFe4b4825457c636ce7de43b8753722e36T1204 · T1221CVE-2017-0199
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD001E27B5
XLSPackage
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
XMLsharedStrings.xml
XMLstyles.xml
BINtheme
XMLtheme1.xml
BINworksheets
BIN_rels
XMLsheet1.xml.rels
XMLsheet1.xml
BINdrawings
BIN_rels
XMLvmlDrawing1.vml.rels
VMLvmlDrawing1.vml
BINmedia
EMFimage2.emf
EMFimage1.emf
BINembeddings
OFFoleObject2.bin
BINRoot Entry
BINOle
BINCompObj
PDFCONTENTS
BINText (Preview)
TXTPage #1
BIN#Stream obj 20 0
BIN#Stream obj 8 0
BIN#Stream obj 10 0
BIN#Stream obj 16 0
BIN#Stream obj 18 0
OFFoleObject1.bin
BINRoot Entry
PDFCONTENTS
BINText (Preview)
TXTPage #1
TXTPage #2
TXTPage #3
BIN#Stream obj 3 0
BIN#Stream obj 21 0
BIN#Stream obj 17 0
BIN#Stream obj 32 0
BIN#Stream obj 18 0
BIN#Stream obj 39 0
BIN#Stream obj 40 0
BIN#Stream obj 50 0
BIN#Stream obj 41 0
BIN#Stream obj 26 0
BIN#Stream obj 48 0
BIN#Stream obj 45 0
BIN#Stream obj 10 0
BIN#Stream obj 19 0
BIN#Stream obj 9 0
TXTStructure
BINprinterSettings
BINprinterSettings1.bin
BINdocProps
WMFthumbnail.wmf
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD001E27B6
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
9 / 9
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>bin
Shape
ole:doc>oox:xlsx>oox:media>bin
malicious
4 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | httP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Version | 1.3 |
| CreationDate | D:20260501062429-07'00' |
| ModifiedDate | D:20260501062430-07'00' |
| Producer | http://bfo.com/products/report?version=bforeport-ns-1.2.10-r47746M |
| /Producer | http://bfo.com/products/report?version=bforeport-ns-1.2.10-r47746M |
| /CreationDate | D:20260501062429-07'00' |
| /ModDate | D:20260501062430-07'00' |
| Version | 1.7 |
| CreationDate | D:20261003110002+02'00' |
| ModifiedDate | D:20261003110002+02'00' |
| Title | Remote Desktop Redirected Printer Doc |
| Producer | Microsoft: Print To PDF |
| /CreationDate | D:20261003110002+02'00' |
| /ModDate | D:20261003110002+02'00' |
| /Producer | Microsoft: Print To PDF |
| /Title | Remote Desktop Redirected Printer Doc |
1 malicious · 60 files
OFFe4b4825457c636ce7de43b8753722e36T1204 · T1221CVE-2017-0199
BINRoot Entry
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | httP:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account