Malicious
e62bb1d72781604c255bd9391c389d1e
MS Office Document
MD5: e62bb1d72781604c255bd9391c389d1e
Size: 485.38 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
485.38 KB · 485,376 B
First seen
2026-06-30 09:02 · 3 months ago
Last seen
2026-06-30 09:02 · 3 months ago
Last analysis
2026-07-01 09:09 · 3 months ago
Hashes
MD5
e62bb1d72781604c255bd9391c389d1e
Sha1
8b10a55643785e6cf913dc8c2a6fbd50280c7182
Sha256
561cfc0f5af02ed7c0f75ff56ca280c066b2bb9d675f51321dafe35c7d33f39b
Sha384
54330e0d808301922ef22504fc5d422351a27fd615d19cfaf3ad4627f37efe3441a6d701fc4bb58536dccd364963da0d
Sha512
50fa09fd574b078846c9a91183a82ecad796fc1f7928d21eb31095c9f61c6b2ea558514ea79eed7f4c06975e946b345f5ab7da8ccbf365a15adc6b45383afa63
SSDeep
12288:XAPXRCk+79QG0WW7zzpmszvCfj9fpQJ5yh6D5:XA/EQxEszvChWOm
TLSH
A6A4232931DADE2FC223D2788AC0D586D21DFC671F8CE31B3281339D1475626225F9AB
4 malicious · 73 files
OFFe62bb1d72781604c255bd9391c389d1eT1221
OFF[Repaired @0x00000E00]
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD0002771F
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
BINworksheets
XMLsheet4.xml
XMLsheet2.xml
XMLsheet3.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet7.xml.rels
XMLsheet6.xml.rels
XMLsheet5.xml.rels
XMLsheet4.xml.rels
XMLsheet1.xml
XMLsheet13.xml
XMLsheet12.xml
XMLsheet11.xml
XMLsheet10.xml
XMLsheet9.xml
XMLsheet8.xml
XMLsheet7.xml
XMLsheet6.xml
XMLsheet5.xml
XMLsheet14.xml
XMLsheet15.xml
XMLsheet16.xml
BINmedia
EMFimage1.emf
BINembeddings
OFFoleObject1.bin
BINRoot Entry
BINOle
BINCompObj
PDFCONTENTS
BIN#Stream {UglyToad.PdfPig.Core.XrefLocation}
BINText (Preview)
TXTPage #1
TXTPage #2
TXTPage #3
TXTPage #4
TXTPage #5
TXTPage #6
TXTPage #7
TXTPage #8
TXTPage #9
TXTPage #10
TXTPage #11
TXTStructure
BINdrawings
VMLvmlDrawing1.vml
BIN_rels
XMLvmlDrawing1.vml.rels
XMLsharedStrings.xml
BINtheme
XMLtheme1.xml
XMLstyles.xml
BINprinterSettings
BINprinterSettings4.bin
BINprinterSettings2.bin
BINprinterSettings3.bin
BINprinterSettings1.bin
BINprinterSettings5.bin
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
WMFthumbnail.wmf
XMLcore.xml
XMLapp.xml
BINCompObj
BINMBD00027720
BINOle
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN_VBA_PROJECT
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| CONTENTS | 1.7 |
| CONTENTS | Absa Retail |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | DocFusion |
| CONTENTS | D:20260622120032Z |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | Absa Retail |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential4 malicious · 73 files
OFFe62bb1d72781604c255bd9391c389d1eT1221
OFF[Repaired @0x00000E00]
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD0002771F
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
BINworksheets
BINmedia
BINembeddings
BINdrawings
XMLsharedStrings.xml
BINtheme
XMLstyles.xml
BINprinterSettings
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
BINCompObj
BINMBD00027720
BIN_VBA_PROJECT_CUR
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
e62bb1d72781604c255bd9391c389d1e › Root Entry › MBD0002771F › Package › xl › externalLinks › _rels › externalLink1.xml.rels
URI
URI
mailtohuhuhuhuhuhuhu
e62bb1d72781604c255bd9391c389d1e › Root Entry › MBD0002771F › Package › xl › embeddings › oleObject1.bin › Root Entry › CONTENTS
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account