Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
1.26 MB · 1,259,181 B
First seen
2026-08-21 08:15 · 2 months ago
Last seen
2026-08-21 08:15 · 2 months ago
Last analysis
2026-08-21 08:16 · 2 months ago
Hashes
MD5 068646c0636f8ae1c10f96abceeab373 Sha1 9d6c34ef503d0023676c11d995375c179afe34ea Sha256 42c83d1ac53b0b777fdb9b328cbbaaeb4de74335a06370b615cc88efe82fcf47 Sha384 2d23dcb1a44dd86fcd83842adb002dd5b305bd6e4cb96576e3267e610188824073f077f53cfb637258213bf6dce1d48f Sha512 6da02f27d4891dd6d990b74e3cc2b040b5348d97f87393835fbed2501b9d650adbd8a42aad207ae76e17beabaa93393b6b5c5104a803f685fcb2cb738ffd5b0d SSDeep 24576:p4K4ZBUmOprUKrVS5rOrkndZODjC+J9yQ5niqBWZ5UZquALq/yRmlq3wk3kfJtff:gUHrUKrVS5rOrkndZODv95bC9Lq/40fv TLSH 1B45012D019B4D49CA71D7B4868EC4D248DCAF3D2683641DC64E7BACFB63A1B123D29D
41 malicious · 249 files
XLS068646c0636f8ae1c10f96abceeab373
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
XMLworkbook.xml
BIN_rels
XMLworkbook.xml.rels
BINworksheets
XMLsheet1.xml
XMLsheet2.xml
XMLsheet3.xml
XMLsheet4.xml
XMLsheet5.xml
XMLsheet6.xml
XMLsheet7.xml
XMLsheet8.xml
XMLsheet9.xml
XMLsheet10.xml
XMLsheet11.xml
XMLsheet12.xml
XMLsheet13.xml
XMLsheet14.xml
BIN_rels
XMLsheet1.xml.rels
OFFsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet4.xml.rels
XMLsheet5.xml.rels
XMLsheet6.xml.rels
XMLsheet7.xml.rels
XMLsheet8.xml.rels
XMLsheet9.xml.rels
XMLsheet10.xml.rels
XMLsheet12.xml.rels
XMLsheet13.xml.rels
XMLsheet14.xml.rels
XMLsheet11.xml.rels
BINtheme
XMLtheme1.xml
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
XMLdrawing1.xml
XMLdrawing10.xml
XMLdrawing2.xml
VMLvmlDrawing1.vml
VMLvmlDrawing9.vml
XMLdrawing11.xml
XMLdrawing12.xml
VMLvmlDrawing11.vml
XMLdrawing13.xml
VMLvmlDrawing12.vml
XMLdrawing3.xml
VMLvmlDrawing2.vml
XMLdrawing4.xml
VMLvmlDrawing3.vml
XMLdrawing5.xml
VMLvmlDrawing4.vml
BIN_rels
XMLdrawing1.xml.rels
XMLdrawing2.xml.rels
XMLdrawing3.xml.rels
XMLdrawing13.xml.rels
VMLvmlDrawing10.vml
XMLdrawing6.xml
VMLvmlDrawing5.vml
XMLdrawing7.xml
VMLvmlDrawing6.vml
XMLdrawing8.xml
VMLvmlDrawing7.vml
XMLdrawing9.xml
VMLvmlDrawing8.vml
BINmedia
IMGimage1.jpeg
IMGimage1.jpeg-preview.png
IMGimage2.jpeg
IMGimage2.jpeg-preview.png
IMGimage3.png
IMGimage3.png-preview.png
IMGimage4.png
IMGimage4.png-preview.png
IMGimage5.png
IMGimage5.png-preview.png
IMGimage6.png
IMGimage6.png-preview.png
IMGimage7.png
IMGimage7.png-preview.png
IMGimage8.png
IMGimage8.png-preview.png
IMGimage10.png
IMGimage10.png-preview.png
IMGimage9.png
IMGimage9.png-preview.png
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAHoja2
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja3
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja4
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja5
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja6
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja7
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja8
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja9
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja10
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja11
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja12
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja13
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAmdAesCtr
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
VBAModCapitulo4
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo5
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo6
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo7
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo8
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo9
VBS[Stored VBA]
VBA[PCode]
VBSModEnvioData
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS_VBA_PROJECT
VBALoginUserForm
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSModValidacion
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
BINLoginUserForm
BINf
BINo
BINCompObj
BINVBFrame
BINprinterSettings
BINprinterSettings1.bin
BINprinterSettings2.bin
BINprinterSettings7.bin
BINprinterSettings9.bin
BINprinterSettings8.bin
BINprinterSettings10.bin
BINprinterSettings12.bin
BINctrlProps
XMLctrlProp1.xml
XMLcomments1.xml
XMLcalcChain.xml
BINcustomXml
XMLitem1.xml
XMLitemProps1.xml
XMLitemProps2.xml
XMLitem3.xml
XMLitemProps3.xml
BIN_rels
XMLitem1.xml.rels
XMLitem2.xml.rels
XMLitem3.xml.rels
XMLitem2.xml
BINdocProps
XMLcore.xml
XMLapp.xml
XMLcustom.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
12 / 12
Path oox:xlsm~T1027~T1059.005>oox:media>img
Shape oox:xlsm>oox:media>img
technique3 nodes
Path oox:xlsm~T1027~T1059.005>bin
Shape oox:xlsm>bin
technique2 nodes
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
41 malicious · 249 files
XLS068646c0636f8ae1c10f96abceeab373
XML[Content_Types].xml
BINxl
XMLworkbook.xml
XMLstyles.xml
XMLsharedStrings.xml
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAHoja2
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja3
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja4
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja5
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja6
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja7
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja8
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja9
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja10
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja11
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja12
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja13
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAmdAesCtr
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
VBAModCapitulo4
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo5
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo6
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo7
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo8
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo9
VBS[Stored VBA]
VBA[PCode]
VBSModEnvioData
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS_VBA_PROJECT
VBALoginUserForm
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSModValidacion
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
XMLcomments1.xml
XMLcalcChain.xml

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
Hoja2
VBA Macro
Hoja3
VBA Macro
Hoja4
VBA Macro
Hoja5
VBA Macro
Hoja6
VBA Macro
Hoja7
VBA Macro
Hoja8
VBA Macro
Hoja9
VBA Macro
Hoja10
Blacklist VBA
VBA Macro
Hoja11
VBA Macro
Hoja12
VBA Macro
Hoja13
VBA Macro
mdAesCtr
Blacklist VBA
VBA Macro
ModCapitulo4
VBA Macro
ModCapitulo5
VBA Macro
ModCapitulo6
VBA Macro
ModCapitulo7
VBA Macro
ModCapitulo8
VBA Macro
ModCapitulo9
VBA Macro
ThisWorkbook
VBA Macro
LoginUserForm
VBA Macro
No malware configuration was found at this point.
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
068646c0636f8ae1c10f96abceeab373 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Decompiled VBA]
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
068646c0636f8ae1c10f96abceeab373 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Decompiled VBA]
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
068646c0636f8ae1c10f96abceeab373 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Decompiled VBA]
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
068646c0636f8ae1c10f96abceeab373 › xl › vbaProject.bin › Root Entry › VBA › Hoja10 › [Decompiled VBA]
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
068646c0636f8ae1c10f96abceeab373 › xl › worksheets › _rels › sheet2.xml.rels
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
068646c0636f8ae1c10f96abceeab373 › xl › worksheets › _rels › sheet2.xml.rels
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙