Malicious
MS Word Document
MD5:
Size: 0 B
application/msword
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
5 malicious · 45 files
DOCe62b0f283b2d8f1eaf08ec2bea27d671T1221
XML[Content_Types].xml
BIN_rels
BINword
BIN_rels
XMLdocument.xml.rels
OFFsettings.xml.relsT1221
XMLdocument.xml
BINmedia
BINembeddings
OFFMicrosoft_Office_Excel_97-2003_Worksheet1.xlsT1221
BINRoot Entry
XLS[Repaired @0x000F3A00]T1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
XMLstyles.xml
BINdrawings
BINworksheets
BINtheme
BINmedia
XMLsharedStrings.xml
BINexternalLinks
BIN_rels
OFFexternalLink1.xml.relsT1221
XMLexternalLink1.xml
BINprinterSettings
BINdocProps
BINtheme
XMLsettings.xml
XMLwebSettings.xml
XMLstyles.xml
XMLfontTable.xml
BINdocProps
| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhu |
| Path | settihuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious
URImalicious
https:huhuhuhuhuhuhu
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential