Malicious
Malicious

043a9f7871ede6dadc140e2f4f83e814

MS Excel Document
MD5: 043a9f7871ede6dadc140e2f4f83e814
Size: 71.74 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 043a9f7871ede6dadc140e2f4f83e814
Sha1 7b1bb407b2f335207c5c4d32b5d791164468163b
Sha256 0985cd773b33739222c66bdd26825f50c2fd0c99648623783a2c83e98e73f0de
Sha384 43c8de7695ee4a861e921e038754187a11cf59f6493d7af7de6713486db0799edd044c5554d0274cfeb64d9b8ddf0172
Sha512 454ee535639225d1e4d690a4562713b40cbf2013d04c0ac89abe7a92f6c55e246b866767d159fc7a7de5e6281ccb83ee7e6a743de9c77537e24d21bdbb4c7858
SSDeep 1536:M/pBqzh/xBXagjVlYJX/gJo6d1n5ZiEyHYqA90GjDyEE1w:MX8pf5j7kX4Jo6TvoAxj+E7
TLSH B063011558C5C5D9D73B383AAE9CDF36AA18540EFD593912304DABE206772C33BB4498
[Content_Types].xml
_rels
.rels
xl
workbook.xml
_rels
workbook.xml.rels
worksheets
sheet1.xml
sheet2.xml
theme
theme1.xml
styles.xml
sharedStrings.xml
vbaProject.bin
Root Entry
PROJECT
PROJECTwm
docProps
core.xml
app.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
8 / 8
Path oox:xlsm~T1059.005>bin
Shape oox:xlsm>bin
technique2 nodes
Path oox:xlsm~T1059.005>ole:doc
Shape oox:xlsm>ole:doc
technique2 nodes
[Content_Types].xml
_rels
.rels
xl
workbook.xml
_rels
workbook.xml.rels
worksheets
sheet1.xml
sheet2.xml
theme
theme1.xml
styles.xml
sharedStrings.xml
vbaProject.bin
Root Entry
PROJECT
PROJECTwm
docProps
core.xml
app.xml

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
ThisWorkbook
Blacklist VBA
VBA Macro
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙