Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
845.43 KB · 845,428 B
First seen
2026-08-21 08:15 · 2 months ago
Last seen
2026-08-21 08:15 · 2 months ago
Last analysis
2026-08-21 08:16 · 2 months ago
Hashes
MD5 0779f13e0573421bdead715549529fef Sha1 6018f0e70d150c320e05910895baad14e65172d8 Sha256 b88c6e388d6ab7702dd19df4196efa75f3e029d46d03873798fee3444d2d0be8 Sha384 510d2923e64f08ee9b773bf00f43ff8fad2a20bbacb5a758d0ef9d82639fff829ad1cd7f78581eae97884d41362c8f53 Sha512 81d360cbb896ce89b1904cf34667526d74caa150cedfd8755892668f008d6c57b91d9925ff46f7d46b5954f13fc894df21e4fc2d18def9ca51e4e2d013241ed8 SSDeep 24576:UMGRs5g55R9dBWZ5UZquALfLqN9cSYW0ZFje:ERsgDC9LoWY TLSH 4E05121F4F0C6849D4AAC3B8E63C97D9540CB3AA8050FC5D2084B9ED6FE1BA6974929D
41 malicious · 220 files
XLS0779f13e0573421bdead715549529fef
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
XMLworkbook.xml
BIN_rels
XMLworkbook.xml.rels
BINworksheets
XMLsheet1.xml
XMLsheet2.xml
XMLsheet3.xml
XMLsheet4.xml
XMLsheet5.xml
XMLsheet6.xml
XMLsheet7.xml
XMLsheet8.xml
XMLsheet9.xml
XMLsheet10.xml
XMLsheet11.xml
XMLsheet12.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet4.xml.rels
XMLsheet5.xml.rels
XMLsheet6.xml.rels
XMLsheet7.xml.rels
XMLsheet9.xml.rels
XMLsheet10.xml.rels
XMLsheet11.xml.rels
XMLsheet12.xml.rels
XMLsheet8.xml.rels
BINtheme
XMLtheme1.xml
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
XMLdrawing1.xml
XMLdrawing10.xml
XMLdrawing2.xml
VMLvmlDrawing1.vml
XMLdrawing11.xml
VMLvmlDrawing10.vml
XMLdrawing12.xml
VMLvmlDrawing11.vml
XMLdrawing3.xml
VMLvmlDrawing2.vml
XMLdrawing4.xml
VMLvmlDrawing3.vml
BIN_rels
XMLdrawing1.xml.rels
XMLdrawing2.xml.rels
XMLdrawing3.xml.rels
XMLdrawing12.xml.rels
XMLdrawing5.xml
VMLvmlDrawing4.vml
VMLvmlDrawing9.vml
XMLdrawing6.xml
VMLvmlDrawing5.vml
XMLdrawing7.xml
VMLvmlDrawing6.vml
XMLdrawing8.xml
VMLvmlDrawing7.vml
XMLdrawing9.xml
VMLvmlDrawing8.vml
BINmedia
IMGimage1.png
IMGimage1.png-preview.png
IMGimage2.jpeg
IMGimage2.jpeg-preview.png
IMGimage3.jpeg
IMGimage3.jpeg-preview.png
IMGimage4.png
IMGimage4.png-preview.png
IMGimage6.png
IMGimage6.png-preview.png
IMGimage5.png
IMGimage5.png-preview.png
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSHoja2
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja3
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSHoja4
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja5
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSHoja6
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja7
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja8
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja9
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSHoja10
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja11
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSHoja12
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAmdAesCtr
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
VBAModHojaC101
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAModHojaC200
VBS[Stored VBA]
VBA[PCode]
VBAModHojaC328
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBAModHojaC400
VBS[Stored VBA]
VBA[PCode]
VBAModHojaC700
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAModMatrices
VBS[Stored VBA]
VBA[PCode]
VBAThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS_VBA_PROJECT
VBALoginUserForm
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSModEnvioDatos
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSModValidacion
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
BINLoginUserForm
BINf
BINo
BINCompObj
BINVBFrame
BINprinterSettings
BINprinterSettings1.bin
BINprinterSettings2.bin
BINprinterSettings11.bin
BINprinterSettings8.bin
BINprinterSettings10.bin
BINctrlProps
XMLctrlProp1.xml
XMLcalcChain.xml
XMLcomments1.xml
BINdocProps
XMLcore.xml
XMLapp.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
11 / 11
Path oox:xlsm~T1027~T1059.005>oox:media>img
Shape oox:xlsm>oox:media>img
technique3 nodes
Path oox:xlsm~T1027~T1059.005>bin
Shape oox:xlsm>bin
technique2 nodes
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
41 malicious · 220 files
XLS0779f13e0573421bdead715549529fef
XML[Content_Types].xml
BINxl
XMLworkbook.xml
XMLstyles.xml
XMLsharedStrings.xml
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSHoja2
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja3
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSHoja4
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja5
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSHoja6
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja7
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja8
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja9
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSHoja10
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja11
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSHoja12
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAmdAesCtr
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
VBAModHojaC101
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAModHojaC200
VBS[Stored VBA]
VBA[PCode]
VBAModHojaC328
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBAModHojaC400
VBS[Stored VBA]
VBA[PCode]
VBAModHojaC700
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAModMatrices
VBS[Stored VBA]
VBA[PCode]
VBAThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS_VBA_PROJECT
VBALoginUserForm
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSModEnvioDatos
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSModValidacion
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
XMLcalcChain.xml
XMLcomments1.xml

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
Hoja3
VBA Macro
Hoja5
VBA Macro
Hoja7
Blacklist VBA
VBA Macro
Hoja8
VBA Macro
Hoja9
VBA Macro
Hoja11
VBA Macro
mdAesCtr
Blacklist VBA
VBA Macro
ModHojaC101
VBA Macro
ModHojaC200
VBA Macro
ModHojaC328
VBA Macro
ModHojaC400
VBA Macro
ModHojaC700
VBA Macro
ModMatrices
VBA Macro
ThisWorkbook
VBA Macro
LoginUserForm
VBA Macro
No malware configuration was found at this point.
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
0779f13e0573421bdead715549529fef › xl › vbaProject.bin › Root Entry › VBA › ModEnvioDatos › [Decompiled VBA]
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
0779f13e0573421bdead715549529fef › xl › vbaProject.bin › Root Entry › VBA › ModEnvioDatos › [Decompiled VBA]
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
0779f13e0573421bdead715549529fef › xl › vbaProject.bin › Root Entry › VBA › ModEnvioDatos › [Decompiled VBA]
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
0779f13e0573421bdead715549529fef › xl › vbaProject.bin › Root Entry › VBA › Hoja7 › [Decompiled VBA]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙