Malicious
MS Office Document
MD5: e7db63de9151113a811e29f1e1988e21
Size: 12.8 KB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
12.8 KB · 12,800 B
First seen
2026-08-31 08:31 · one month ago
Last seen
2026-08-31 08:31 · one month ago
Last analysis
2026-08-31 08:31 · one month ago
Hashes
MD5
e7db63de9151113a811e29f1e1988e21
Sha1
89dd07a48aaaf8c148c1b11af62fbe1d016bb2d8
Sha256
508e710d673802a532798e7dffa3aefcfb36eff0acef1620b8614917ac62e53e
Sha384
cfe36d1b22cdaf7799ae4cd896ae27b176964b340ec6c3fc156248c978445783a89449593d8734a0fac14f8de1dca404
Sha512
851f2890eea3ee7d8446ddcb262800c07defd3a79fb6495c99c4ca61c6d5762eea7b34b6f3342810eeeb02f4f2626d5528b2d9246dcdba142647d4a7151b10b6
SSDeep
192:cRB134wqL5yH+YAo+lnACPr56Q9zK/4dBqJgFs5:cRB1ozsHvAhVACLzK/eBqJD5
TLSH
2B42C487B500C13BD1956E314EABCBA807763C85DE9A11173FB2B34C2EB719035AA3E1
6 malicious · 32 files
OFFe7db63de9151113a811e29f1e1988e21T1027 · T1059.001
BINPs1File
PS1CmdFileT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
BINRoot Entry
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 2
STICH kept: 1secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:ps1
malicious
2 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
-argumhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential