Malicious
Malicious

Share on LinkedIn
Print
MS Office Document
MD5:
Size: 0 B
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
6 malicious · 91 files
OFFef178476d01f641b9d35854967e7cb1d
OFF[Repaired @0x000A05CA]
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD01916067
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BINMBD0054EEB3
XLSPackage
XML[Content_Types].xml
BINxl
XMLworkbook.xml
XMLstyles.xml
XMLsharedStrings.xml
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.rels
BINCompObj
BINMBD0054F8F9
OFFWorkbook
OFF[Repaired @0x00036DCA]
XML[Content_Types].xml
BINSummaryInformation
BINDocumentSummaryInformation
Config. Field Value
Target file:/huhuhuhuhuhuhuhuhuhuhu
Path externhuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
CONTENTS
1.4
CONTENTS
Administrator
CONTENTS
D:20160205164127Z
CONTENTS
PScript5.dll Version 5.2.2
CONTENTS
D:20250905130018+05'30'
CONTENTS
I:\EZHIL\MASTER 1000\1701-1800\2675 1740 - A - COPPER WIRE Model (1)
CONTENTS
GPL Ghostscript 8.15
CONTENTS
Administrator
CONTENTS
D:20160205164127Z
CONTENTS
PScript5.dll Version 5.2.2
CONTENTS
D:20250905130018+05'30'
CONTENTS
GPL Ghostscript 8.15
CONTENTS
I:\EZHIL\MASTER 1000\1701-1800\2675 1740 - A - COPPER WIRE Model (1)
Remote Template - Highly Suspicious URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙