Malicious
Malicious

068646c0636f8ae1c10f96abceeab373

Share on LinkedIn
Print
MS Excel Document
MD5: 068646c0636f8ae1c10f96abceeab373
Size: 1.26 MB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 068646c0636f8ae1c10f96abceeab373
Sha1 9d6c34ef503d0023676c11d995375c179afe34ea
Sha256 42c83d1ac53b0b777fdb9b328cbbaaeb4de74335a06370b615cc88efe82fcf47
Sha384 2d23dcb1a44dd86fcd83842adb002dd5b305bd6e4cb96576e3267e610188824073f077f53cfb637258213bf6dce1d48f
Sha512 6da02f27d4891dd6d990b74e3cc2b040b5348d97f87393835fbed2501b9d650adbd8a42aad207ae76e17beabaa93393b6b5c5104a803f685fcb2cb738ffd5b0d
SSDeep 24576:p4K4ZBUmOprUKrVS5rOrkndZODjC+J9yQ5niqBWZ5UZquALq/yRmlq3wk3kfJtff:gUHrUKrVS5rOrkndZODv95bC9Lq/40fv
TLSH 1B45012D019B4D49CA71D7B4868EC4D248DCAF3D2683641DC64E7BACFB63A1B123D29D
068646c0636f8ae1c10f96abceeab373
Malicious
[Content_Types].xml
_rels
.rels
xl
workbook.xml
_rels
workbook.xml.rels
worksheets
sheet1.xml
sheet2.xml
sheet3.xml
sheet4.xml
sheet5.xml
sheet6.xml
sheet7.xml
sheet8.xml
sheet9.xml
sheet10.xml
sheet11.xml
sheet12.xml
sheet13.xml
sheet14.xml
_rels
sheet1.xml.rels
sheet2.xml.rels
sheet3.xml.rels
sheet4.xml.rels
sheet5.xml.rels
sheet6.xml.rels
sheet7.xml.rels
sheet8.xml.rels
sheet9.xml.rels
sheet10.xml.rels
sheet12.xml.rels
sheet13.xml.rels
sheet14.xml.rels
sheet11.xml.rels
theme
theme1.xml
styles.xml
sharedStrings.xml
drawings
drawing1.xml
drawing10.xml
drawing2.xml
vmlDrawing1.vml
vmlDrawing9.vml
drawing11.xml
drawing12.xml
vmlDrawing11.vml
drawing13.xml
vmlDrawing12.vml
drawing3.xml
vmlDrawing2.vml
drawing4.xml
vmlDrawing3.vml
drawing5.xml
vmlDrawing4.vml
_rels
drawing1.xml.rels
drawing2.xml.rels
drawing3.xml.rels
drawing13.xml.rels
vmlDrawing10.vml
drawing6.xml
vmlDrawing5.vml
drawing7.xml
vmlDrawing6.vml
drawing8.xml
vmlDrawing7.vml
drawing9.xml
vmlDrawing8.vml
media
image1.jpeg
image1.jpeg-preview.png
image2.jpeg
image2.jpeg-preview.png
image3.png
image3.png-preview.png
image4.png
image4.png-preview.png
image5.png
image5.png-preview.png
image6.png
image6.png-preview.png
image7.png
image7.png-preview.png
image8.png
image8.png-preview.png
image10.png
image10.png-preview.png
image9.png
image9.png-preview.png
vbaProject.bin
Root Entry
PROJECT
PROJECTwm
VBA
dir
Hoja2

Hoja2

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja3

Hoja3

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja4

Hoja4

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja5

Hoja5

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja6

Hoja6

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja7

Hoja7

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja8

Hoja8

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja9

Hoja9

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja10

Hoja10

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja11

Hoja11

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja12

Hoja12

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja13

Hoja13

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
__SRP_0
__SRP_1
__SRP_2
__SRP_3
__SRP_4
__SRP_5
__SRP_6
__SRP_7
__SRP_8
__SRP_9
__SRP_a
__SRP_b
__SRP_c
__SRP_d
__SRP_e
__SRP_f
mdAesCtr

mdAesCtr

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
__SRP_10
__SRP_11
__SRP_12
__SRP_13
__SRP_14
__SRP_15
__SRP_16
__SRP_17
__SRP_18
__SRP_19
__SRP_1a
__SRP_1b
__SRP_1c
__SRP_1d
__SRP_1e
__SRP_1f
__SRP_20
__SRP_21
__SRP_22
__SRP_23
__SRP_24
__SRP_25
__SRP_26
__SRP_27
__SRP_28
__SRP_29
__SRP_2a
__SRP_2b
__SRP_2c
__SRP_2d
ModCapitulo4

ModCapitulo4

[Stored VBA]
Malicious
[PCode]
ModCapitulo5

ModCapitulo5

[Stored VBA]
Malicious
[PCode]
ModCapitulo6

ModCapitulo6

[Stored VBA]
Malicious
[PCode]
ModCapitulo7

ModCapitulo7

[Stored VBA]
Malicious
[PCode]
ModCapitulo8

ModCapitulo8

[Stored VBA]
Malicious
[PCode]
ModCapitulo9

ModCapitulo9

[Stored VBA]
Malicious
[PCode]
ModEnvioData
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
ThisWorkbook

ThisWorkbook

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
_VBA_PROJECT
LoginUserForm

LoginUserForm

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
ModValidacion
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
[Decompiled VBA].deobfuscated.vbs
LoginUserForm
f
o
CompObj
VBFrame
printerSettings
printerSettings1.bin
printerSettings2.bin
printerSettings7.bin
printerSettings9.bin
printerSettings8.bin
printerSettings10.bin
printerSettings12.bin
ctrlProps
ctrlProp1.xml
comments1.xml
calcChain.xml
customXml
item1.xml
itemProps1.xml
itemProps2.xml
item3.xml
itemProps3.xml
_rels
item1.xml.rels
item2.xml.rels
item3.xml.rels
item2.xml
docProps
core.xml
app.xml
custom.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
12 / 12
Path oox:xlsm~T1027~T1059.005>oox:media>img
Shape oox:xlsm>oox:media>img
technique3 nodes
Path oox:xlsm~T1027~T1059.005>bin
Shape oox:xlsm>bin
technique2 nodes
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙