Malicious
e4e9c3cc4d6c1ddc91e5860374bf15ca
MS Office Document
MD5: e4e9c3cc4d6c1ddc91e5860374bf15ca
Size: 1.2 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | e4e9c3cc4d6c1ddc91e5860374bf15ca |
| Sha1 | cc8f4dcaa4e432790a1bf007dfccf7a39cc53178 |
| Sha256 | 70e99bea1099f7fbd8ba62409602d35e1fbee8f0e01ef51664922757da8c1b97 |
| Sha384 | 23a6d19e5cd00e529491df58106a12d63d84bd9163929ef29f14a461f1816e7460655b371362407c64cfbdab545c3fb4 |
| Sha512 | 520dec897ac5d942e6cbd9507c4e71adf0cb37333073ceaf50b234e27c45ae18508f9e115fdd707127d3c28d1d0fa0a7ed5a9a30e426658cfda606256712cf81 |
| SSDeep | 24576:HlBIIw2T547EdvASx/OfnSWOKsy1STb2+aBa0VmJq:HlLTe7EdoSEfSvKsHTb2+aBHr |
| TLSH | 4D452318FAA3F2A3C4A3DFBB0956D5CA01A66C946714C323B215771E5CF5337AAC1389 |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
11 / 11
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>img>img
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>img>img
malicious
7 nodes
Path
ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape
ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious
6 nodes
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Version | 1.7 |
| CreationDate | D:20260804170815 |
| Creator | PDFium |
| Producer | PDFium |
| Version | 1.3 |
| Author | root |
| CreationDate | D:20110827122753+05'30' |
| Creator | Style Report |
| ModifiedDate | D:20250428111501+05'30' |
| Producer | Style Report |
| /CreationDate | D:20260804170815 |
| /Creator | PDFium |
| /Producer | PDFium |
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
URI
URI
http:/huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL distante (OLE moniker) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URI
URI
https:huhuhuhuhuhuhuhuhuhuhu
e4e9c3cc4d6c1ddc91e5860374bf15ca › Root Entry › MBD0181EF41 › Package › xl › embeddings › oleObject1.bin › Root Entry › CONTENTS
URI
URI
http:/huhuhuhuhuhuhu
e4e9c3cc4d6c1ddc91e5860374bf15ca › Root Entry › MBD0181EF41 › Package › xl › embeddings › oleObject2.bin › Root Entry › CONTENTS
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.