Malicious
MS Office Document
MD5: e62bb1d72781604c255bd9391c389d1e
Size: 485.38 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
485.38 KB · 485,376 B
First seen
2026-06-30 09:02 · 3 months ago
Last seen
2026-06-30 09:02 · 3 months ago
Last analysis
2026-07-01 09:09 · 3 months ago
Hashes
MD5
e62bb1d72781604c255bd9391c389d1e
Sha1
8b10a55643785e6cf913dc8c2a6fbd50280c7182
Sha256
561cfc0f5af02ed7c0f75ff56ca280c066b2bb9d675f51321dafe35c7d33f39b
Sha384
54330e0d808301922ef22504fc5d422351a27fd615d19cfaf3ad4627f37efe3441a6d701fc4bb58536dccd364963da0d
Sha512
50fa09fd574b078846c9a91183a82ecad796fc1f7928d21eb31095c9f61c6b2ea558514ea79eed7f4c06975e946b345f5ab7da8ccbf365a15adc6b45383afa63
SSDeep
12288:XAPXRCk+79QG0WW7zzpmszvCfj9fpQJ5yh6D5:XA/EQxEszvChWOm
TLSH
A6A4232931DADE2FC223D2788AC0D586D21DFC671F8CE31B3281339D1475626225F9AB
4 malicious · 73 files
OFFe62bb1d72781604c255bd9391c389d1eT1221
OFF[Repaired @0x00000E00]
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD0002771F
XLSPackageT1221
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
BINworksheets
BINmedia
BINembeddings
BINdrawings
XMLsharedStrings.xml
BINtheme
XMLstyles.xml
BINprinterSettings
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINdocProps
BINCompObj
BINMBD00027720
BIN_VBA_PROJECT_CUR
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| CONTENTS | 1.7 |
| CONTENTS | Absa Retail |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | DocFusion |
| CONTENTS | D:20260622120032Z |
| CONTENTS | D:20260622120032Z |
| CONTENTS | DocFusion |
| CONTENTS | Absa Retail |
Remote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
URI
URI
mailtohuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential