e7db63de9151113a811e29f1e1988e21

MS Office Document

MD5: e7db63de9151113a811e29f1e1988e21

Size: 12.8 KB

application/vnd.ms-office

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

MD5	e7db63de9151113a811e29f1e1988e21
Sha1	89dd07a48aaaf8c148c1b11af62fbe1d016bb2d8
Sha256	508e710d673802a532798e7dffa3aefcfb36eff0acef1620b8614917ac62e53e
Sha384	cfe36d1b22cdaf7799ae4cd896ae27b176964b340ec6c3fc156248c978445783a89449593d8734a0fac14f8de1dca404
Sha512	851f2890eea3ee7d8446ddcb262800c07defd3a79fb6495c99c4ca61c6d5762eea7b34b6f3342810eeeb02f4f2626d5528b2d9246dcdba142647d4a7151b10b6
SSDeep	192:cRB134wqL5yH+YAo+lnACPr56Q9zK/4dBqJgFs5:cRB1ozsHvAhVACLzK/eBqJD5
TLSH	2B42C487B500C13BD1956E314EABCBA807763C85DE9A11173FB2B34C2EB719035AA3E1

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path ole:doc>scr:ps1~T1027~T1059.001

Shape ole:doc>scr:ps1

malicious 2 nodes

Deobfuscated PowerShell UNKNWOWNmalicious

Start-huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

-argumhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

Deobfuscated PowerShell UNKNWOWNmalicious

Start-huhuhuhuhuhuhuhuhuhuhu

e7db63de9151113a811e29f1e1988e21 › CmdFile › [PowerShell Command]

Deobfuscated PowerShell UNKNWOWNmalicious

-argumhuhuhuhuhuhuhuhuhuhuhu

e7db63de9151113a811e29f1e1988e21 › CmdFile › [PowerShell Command] › [PowerShell Command]

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.