Malicious
Malicious

e4e9c3cc4d6c1ddc91e5860374bf15ca

Share on LinkedIn
Print
MS Office Document
MD5: e4e9c3cc4d6c1ddc91e5860374bf15ca
Size: 1.2 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e4e9c3cc4d6c1ddc91e5860374bf15ca
Sha1 cc8f4dcaa4e432790a1bf007dfccf7a39cc53178
Sha256 70e99bea1099f7fbd8ba62409602d35e1fbee8f0e01ef51664922757da8c1b97
Sha384 23a6d19e5cd00e529491df58106a12d63d84bd9163929ef29f14a461f1816e7460655b371362407c64cfbdab545c3fb4
Sha512 520dec897ac5d942e6cbd9507c4e71adf0cb37333073ceaf50b234e27c45ae18508f9e115fdd707127d3c28d1d0fa0a7ed5a9a30e426658cfda606256712cf81
SSDeep 24576:HlBIIw2T547EdvASx/OfnSWOKsy1STb2+aBa0VmJq:HlLTe7EdoSEfSvKsHTb2+aBHr
TLSH 4D452318FAA3F2A3C4A3DFBB0956D5CA01A66C946714C323B215771E5CF5337AAC1389
e4e9c3cc4d6c1ddc91e5860374bf15ca
Malicious
Root Entry
CompObj
Workbook
SummaryInformation
DocumentSummaryInformation
MBD0181EF41
Package
[Content_Types].xml
_rels
.rels
xl
_rels
workbook.xml.rels
workbook.xml
sharedStrings.xml
styles.xml
theme
theme1.xml
worksheets
_rels
sheet1.xml.rels
sheet1.xml
drawings
_rels
vmlDrawing1.vml.rels
vmlDrawing1.vml
media
image2.emf
image1.emf
embeddings
oleObject2.bin
Root Entry
Ole
CompObj
CONTENTS
Text (Preview)
Page #1
#Stream obj 6 0
#Stream obj 21 0
#Stream obj 13 0
#Stream obj 15 0
#Stream obj 16 0
#Stream obj 19 0
#Stream obj 17 0
#Stream obj 18 0
oleObject1.bin
Root Entry
CONTENTS
Text (Preview)
Page #1
Page #2
Page #3
Page #4
#Stream obj 46 0
#Stream obj 50 0
#Stream obj 49 0
#Stream obj 18 0
#Stream obj 29 0
#Stream obj 34 0
#Stream obj 34 0.exif
#Stream obj 34 0-preview.png
#Stream obj 31 0
#Stream obj 30 0
#Stream obj 21 0
#Stream obj 21 0-preview.png
#Stream obj 35 0
#Stream obj 37 0
#Stream obj 36 0
#Stream obj 24 0
#Stream obj 28 0
#Stream obj 27 0
#Stream obj 38 0
#Stream obj 32 0
#Stream obj 33 0
#Stream obj 40 0
#Stream obj 43 0
#Stream obj 2 0
#Stream obj 3 0
#Stream obj 4 0
#Stream obj 7 0
#Stream obj 8 0
#Stream obj 9 0
Structure
printerSettings
printerSettings1.bin
docProps
core.xml
app.xml
CompObj
MBD0181EF42
Ole
_VBA_PROJECT_CUR
PROJECT
PROJECTwm
VBA
dir
_VBA_PROJECT
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
11 / 11
Path ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>img>img
Shape ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>img>img
malicious 7 nodes
Path ole:doc~T1204~T1221>oox:xlsx>oox:media>pdf>pdf:stream>bin
Shape ole:doc>oox:xlsx>oox:media>pdf>pdf:stream>bin
malicious 6 nodes
Config. Field Value
URL distante (OLE moniker) #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Version
1.7
CreationDate
D:20260804170815
Creator
PDFium
Producer
PDFium
Version
1.3
Author
root
CreationDate
D:20110827122753+05'30'
Creator
Style Report
ModifiedDate
D:20250428111501+05'30'
Producer
Style Report
/CreationDate
D:20260804170815
/Creator
PDFium
/Producer
PDFium
URI URI
https:huhuhuhuhuhuhuhuhuhuhu
URI URI
http:/huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙