068646c0636f8ae1c10f96abceeab373

MS Excel Document

MD5: 068646c0636f8ae1c10f96abceeab373

Size: 1.26 MB

application/vnd.ms-excel

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

MD5	068646c0636f8ae1c10f96abceeab373
Sha1	9d6c34ef503d0023676c11d995375c179afe34ea
Sha256	42c83d1ac53b0b777fdb9b328cbbaaeb4de74335a06370b615cc88efe82fcf47
Sha384	2d23dcb1a44dd86fcd83842adb002dd5b305bd6e4cb96576e3267e610188824073f077f53cfb637258213bf6dce1d48f
Sha512	6da02f27d4891dd6d990b74e3cc2b040b5348d97f87393835fbed2501b9d650adbd8a42aad207ae76e17beabaa93393b6b5c5104a803f685fcb2cb738ffd5b0d
SSDeep	24576:p4K4ZBUmOprUKrVS5rOrkndZODjC+J9yQ5niqBWZ5UZquALq/yRmlq3wk3kfJtff:gUHrUKrVS5rOrkndZODv95bC9Lq/40fv
TLSH	1B45012D019B4D49CA71D7B4868EC4D248DCAF3D2683641DC64E7BACFB63A1B123D29D

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

12 / 12

Path oox:xlsm~T1027~T1059.005>oox:media>img

Shape oox:xlsm>oox:media>img

technique3 nodes

Path oox:xlsm~T1027~T1059.005>bin

Shape oox:xlsm>bin

technique2 nodes

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	Hoja2	VBA Macro
	Hoja3	VBA Macro
	Hoja4	VBA Macro
	Hoja5	VBA Macro
	Hoja6	VBA Macro
	Hoja7	VBA Macro
	Hoja8	VBA Macro
	Hoja9	VBA Macro
	Hoja10	Blacklist VBA VBA Macro
	Hoja11	VBA Macro
	Hoja12	VBA Macro
	Hoja13	VBA Macro
	mdAesCtr	Blacklist VBA VBA Macro
	ModCapitulo4	VBA Macro
	ModCapitulo5	VBA Macro
	ModCapitulo6	VBA Macro
	ModCapitulo7	VBA Macro
	ModCapitulo8	VBA Macro
	ModCapitulo9	VBA Macro
	ThisWorkbook	VBA Macro
	LoginUserForm	VBA Macro

No malware configuration was found at this point.

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

068646c0636f8ae1c10f96abceeab373 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Decompiled VBA]

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

068646c0636f8ae1c10f96abceeab373 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Decompiled VBA]

URLs in VB Code - #3 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

068646c0636f8ae1c10f96abceeab373 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Decompiled VBA]

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

068646c0636f8ae1c10f96abceeab373 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Stored VBA]

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

068646c0636f8ae1c10f96abceeab373 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Stored VBA]

URLs in VB Code - #3 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

068646c0636f8ae1c10f96abceeab373 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Stored VBA]

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

068646c0636f8ae1c10f96abceeab373 › xl › vbaProject.bin › Root Entry › VBA › Hoja10 › [Decompiled VBA]

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

068646c0636f8ae1c10f96abceeab373 › xl › vbaProject.bin › Root Entry › VBA › Hoja10 › [Stored VBA]

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhu

068646c0636f8ae1c10f96abceeab373 › xl › worksheets › _rels › sheet2.xml.rels

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhu

068646c0636f8ae1c10f96abceeab373 › xl › worksheets › _rels › sheet2.xml.rels

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.