Malicious
e91dd8f635c1364a2255f027ea8a0be7
MS Office Document
MD5: e91dd8f635c1364a2255f027ea8a0be7
Size: 2.41 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | e91dd8f635c1364a2255f027ea8a0be7 |
| Sha1 | 90f04968461467f0bfac8094f71f8941349b4edb |
| Sha256 | 9edfda3b77b3973f37708add497130d44cd88374c85812926f7974687006e3e5 |
| Sha384 | f0d90e2e32e5546da6b4987f9204ba481cd0995c509d8b6209dfdf31769bac006e3eea4fcffeac96d3c9543c28258546 |
| Sha512 | a38460cc13348ba40fd1cfb143e64ac0019b8f3e1cfc09632fb55acb4d5919e35c7d475a86b011f9c1520d21717cddb53a58240c52d628a91dacab4740e76f51 |
| SSDeep | 49152:TnhPvPvPvPvPv6ffffcoXSpmBH4AmLUR4D8C6VnH5ijZTSylVaa:PoFBHwARe8C6VniZ+WVZ |
| TLSH | 15B54B636A50600542B1A8FABEBD5E37794F3409101AD98EFFD34B86F51E6F84802E1F |
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 2
STICH kept: 1secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
ole:doc>scr:ps1~T1027~T1059.001
Shape
ole:doc>scr:ps1
malicious
2 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
e91dd8f635c1364a2255f027ea8a0be7 › Root Entry › 䡀㼿䕷䑬㭪䗤䠤 › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
"$env:huhuhuhuhuhuhuhuhuhuhu
e91dd8f635c1364a2255f027ea8a0be7 › Root Entry › 䡀㼿䕷䑬㭪䗤䠤 › [Deobfuscated PS] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.