Malicious
Malicious

0302eec059217d6e4d89ea738174e372

MS Office Document
|
MD5: 0302eec059217d6e4d89ea738174e372
|
Size: 158.21 KB
|
application/vnd.ms-office

Infection Chain
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
0302eec059217d6e4d89ea738174e372
Sha1
7229076d79c8c1a6794c86056e0d661e4611ed49
Sha256
96502cd36566576fd7ca157915684fd5c826364b31eb51bb57dda50f51819374
Sha384
e14719f6102b9413e0b03f41059dfc14a5bd197893f4dfcee147747a7120fc5e1ae10503a52336df97c0e63ba45079d8
Sha512
567186c2abb9a11071e7ad66cec7f31c8c13a19b98b6c0b79b65e7002b108969c1f2458becfebf71d5a79916032a6f7c42681e9b822e66ae072743ba6bf41994
SSDeep
3072:eH/pTzyqtdQ2YJlAZiV8TtnFi76N7X872Rx8DI1uQ/UwQ4g9P:g/pyqvQ3JleikBFE6VXKw
TLSH
8EF3C07835E5FC1AFCA0C0301FA6DABEE75DAC14B9C2412712063F7D293A6E9871A745
File Structure
0302eec059217d6e4d89ea738174e372
Malicious
[Repaired @0x00018000]
Malicious
[Content_Types].xml
_rels
.rels
theme
theme
themeManager.xml
theme1.xml
_rels
themeManager.xml.rels
Root Entry
Malicious
Data
1Table
Malicious
[Repaired @0x00000600]
Malicious
CompObj
WordDocument
SummaryInformation
DocumentSummaryInformation
Macros
Malicious
PROJECT
PROJECTwm
VBA
Malicious
dir
ThisDocument
Malicious

ThisDocument

Malicious
[Stored VBA]
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Full Diff]
Malicious
[Partial Diff]
Malicious
_VBA_PROJECT
0302eec059217d6e4d89ea738174e372 (158.21 KB)
File Structure
0302eec059217d6e4d89ea738174e372
Malicious
[Repaired @0x00018000]
Malicious
[Content_Types].xml
_rels
.rels
theme
theme
themeManager.xml
theme1.xml
_rels
themeManager.xml.rels
Root Entry
Malicious
Data
1Table
Malicious
[Repaired @0x00000600]
Malicious
CompObj
WordDocument
SummaryInformation
DocumentSummaryInformation
Macros
Malicious
PROJECT
PROJECTwm
VBA
Malicious
dir
ThisDocument
Malicious

ThisDocument

Malicious
[Stored VBA]
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Full Diff]
Malicious
[Partial Diff]
Malicious
_VBA_PROJECT
Characteristics

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
ThisDocument
VBA Stomping
ATT&CK T1564.007
Malicious
Malicious Document
Blacklist VBA
VBA Macro

Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis.

VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams.

To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective.

This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙