Malicious
e7db63de9151113a811e29f1e1988e21
MS Office Document
MD5: e7db63de9151113a811e29f1e1988e21
Size: 12.8 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
12.8 KB · 12,800 B
First seen
2026-08-31 08:31 · one month ago
Last seen
2026-08-31 08:31 · one month ago
Last analysis
2026-08-31 08:31 · one month ago
Hashes
MD5
e7db63de9151113a811e29f1e1988e21
Sha1
89dd07a48aaaf8c148c1b11af62fbe1d016bb2d8
Sha256
508e710d673802a532798e7dffa3aefcfb36eff0acef1620b8614917ac62e53e
Sha384
cfe36d1b22cdaf7799ae4cd896ae27b176964b340ec6c3fc156248c978445783a89449593d8734a0fac14f8de1dca404
Sha512
851f2890eea3ee7d8446ddcb262800c07defd3a79fb6495c99c4ca61c6d5762eea7b34b6f3342810eeeb02f4f2626d5528b2d9246dcdba142647d4a7151b10b6
SSDeep
192:cRB134wqL5yH+YAo+lnACPr56Q9zK/4dBqJgFs5:cRB1ozsHvAhVACLzK/eBqJD5
TLSH
2B42C487B500C13BD1956E314EABCBA807763C85DE9A11173FB2B34C2EB719035AA3E1
6 malicious · 32 files
OFFe7db63de9151113a811e29f1e1988e21T1027 · T1059.001
BINPs1File
PS1CmdFileT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
BINRoot Entry
BIN䡀䌏䈯
BIN䄧䄷䆾䅤
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䓞䕪䇤䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䈛䒰䈹䌏䈯
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀䕌䄨䈷䒏䇯䕨
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN䡀䄕䑸䋦䒌䇱䗬䒬䠱
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 2
STICH kept: 1secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:ps1
malicious
2 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
-argumhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 32 files
OFFe7db63de9151113a811e29f1e1988e21T1027 · T1059.001
BINPs1File
PS1CmdFileT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
BINRoot Entry
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
e7db63de9151113a811e29f1e1988e21 › CmdFile › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
-argumhuhuhuhuhuhuhuhuhuhuhu
e7db63de9151113a811e29f1e1988e21 › CmdFile › [PowerShell Command] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account