The szok 2025 exe (Microsoft Office Word) Microsoft Corporation File Malware Analysis

The szok __2025.exe (Microsoft Office Word) File Analysis

Updated 2 days ago

Checked by Malware Check

szok __2025.exe

Hash Type	Value	Action
MD5	2e09139186fa25002963edd55a1f123f
SHA1	1052ab1763620338ddb2899cd7e0dd720dbd34de
SHA256	495ec48f6c46a4db3e720b255b1d9300f8ff783be89dfb5afbcf10c8f312a9e2
SHA512	bb2120e920986bc559106a52a90af3b7ae119c7fadabfd98f915907fada2c490d035b30babf456120d17fc0a52723996312508f69b9771d3d8ca0c5c1ee49dac
ImpHash	800791d629f3931f5abf0f4be5d7669b

Hash Type

Value

Action

MD5

2e09139186fa25002963edd55a1f123f

SHA1

1052ab1763620338ddb2899cd7e0dd720dbd34de

SHA256

495ec48f6c46a4db3e720b255b1d9300f8ff783be89dfb5afbcf10c8f312a9e2

SHA512

bb2120e920986bc559106a52a90af3b7ae119c7fadabfd98f915907fada2c490d035b30babf456120d17fc0a52723996312508f69b9771d3d8ca0c5c1ee49dac

ImpHash

800791d629f3931f5abf0f4be5d7669b

PE Analysis

Basic Information

▼

Icon	Hash: 6903c9c1d287d93a1b390b2284c80ddd Fuzzy: 88d2b7cf6a8ac5113314c80c199faebe dHash: 74f4ecc4caccc4dc
Image Base	`0x140000000`
Entry Point	`0x14000132b`
Compilation Time	1970-01-01 00:00:00
Checksum	0x007e5c3d (Actual: 0x007e5c3d)
OS Version	4.0
PEiD Signatures	`PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	20 libraries
Exports	0 functions
Resources	26 Resources
Sections	11 Sections

Version Information

▼

CompanyName	Microsoft Corporation
FileDescription	Microsoft Office Word
FileVersion	16.0.14332.20336
ProductVersion	16.0.14332.20336
LegalCopyright	Microsoft Corporation. All rights reserved.
OriginalFilename	WINWORD.EXE
ProductName	Microsoft Office 2021
InternalName	WINWORD
LegalTrademarks	Microsoft and the Office logo are trademarks of Microsoft Corporation.
PrivateBuild	Built by Office Team
SpecialBuild	Release - production
Translation	0x0409 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	5,857,824 bytes	5,858,304 bytes	6.28 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`CC44662251CCE34B83766B4474F2D19C`
`.data`	`0x00598000`	79,760 bytes	79,872 bytes	1.50 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`4CA70F5F9C4C82C569645647D2B32A6E`
`.rdata`	`0x005ac000`	1,526,976 bytes	1,527,296 bytes	5.92 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`1E6FE9C97751ED71F6764056DB0B9B63`
`.qtmimed`	`0x00721000`	49,152 bytes	49,152 bytes	7.74 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E75FD4BD21CE6F8EEED24F8FFE775FEE`
`.pdata`	`0x0072d000`	209,916 bytes	209,920 bytes	6.39 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`A98ED2237D40B75367E2BFC6AE4A6128`
`.xdata`	`0x00761000`	288,272 bytes	288,768 bytes	5.22 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`AF839A49E47F5D308CBBA6917EFFDD61`
`.bss`	`0x007a8000`	5,632 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x007aa000`	17,776 bytes	17,920 bytes	4.40 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`A494D9776E8D591C8520E16BCF3D8495`
`.tls`	`0x007af000`	16 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x007b0000`	193,136 bytes	193,536 bytes	3.05 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8A3406ECBCD60F970A7E1A4DD59A30EB`
`.reloc`	`0x007e0000`	25,060 bytes	25,088 bytes	5.46 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`CB2BD46E4DBE028577B0C4B4950D0F70`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼

Total Resources: 26 (191,768 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	24	190,258 bytes	99.2%
RT_GROUP_ICON	1	342 bytes	0.2%
RT_VERSION	1	1,168 bytes	0.6%

Certificate Chain Analysis

▼

Certificate Information

Product	Microsoft Office 2021
Description	Microsoft Office Word
File Version	16.0.14332.20336
Original Name	WINWORD.EXE
Internal Name	WINWORD
Copyright	Microsoft Corporation. All rights reserved.

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	szok __2025.exe
File Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Scanner Version	1.0.226.174
Database Version	2025-10-03 14:00:26 UTC

The szok __2025.exe (Microsoft Office Word) File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification