Malicious
MS Excel Document
MD5: 0779f13e0573421bdead715549529fef
Size: 845.43 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
845.43 KB · 845,428 B
First seen
2026-08-21 08:15 · 2 months ago
Last seen
2026-08-21 08:15 · 2 months ago
Last analysis
2026-08-21 08:16 · 2 months ago
Hashes
MD5
0779f13e0573421bdead715549529fef
Sha1
6018f0e70d150c320e05910895baad14e65172d8
Sha256
b88c6e388d6ab7702dd19df4196efa75f3e029d46d03873798fee3444d2d0be8
Sha384
510d2923e64f08ee9b773bf00f43ff8fad2a20bbacb5a758d0ef9d82639fff829ad1cd7f78581eae97884d41362c8f53
Sha512
81d360cbb896ce89b1904cf34667526d74caa150cedfd8755892668f008d6c57b91d9925ff46f7d46b5954f13fc894df21e4fc2d18def9ca51e4e2d013241ed8
SSDeep
24576:UMGRs5g55R9dBWZ5UZquALfLqN9cSYW0ZFje:ERsgDC9LoWY
TLSH
4E05121F4F0C6849D4AAC3B8E63C97D9540CB3AA8050FC5D2084B9ED6FE1BA6974929D
41 malicious · 220 files
XLS0779f13e0573421bdead715549529fefT1027 · T1059.005
XML[Content_Types].xml
BIN_rels
BINxl
XMLworkbook.xml
BIN_rels
BINworksheets
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
BINmedia
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSHoja2
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja3
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSHoja4
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja5
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSHoja6
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja7
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja8
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja9
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSHoja10
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja11
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSHoja12
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAmdAesCtr
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
VBAModHojaC101
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAModHojaC200
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModHojaC328
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAModHojaC400
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModHojaC700
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAModMatrices
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
VBALoginUserForm
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSModEnvioDatos
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSModValidacion
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BINLoginUserForm
BINprinterSettings
BINctrlProps
XMLcalcChain.xml
XMLcomments1.xml
BINdocProps
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
11 / 11
Path
oox:xlsm~T1027~T1059.005>oox:media>img
Shape
oox:xlsm>oox:media>img
technique3 nodes
Path
oox:xlsm~T1027~T1059.005>bin
Shape
oox:xlsm>bin
technique2 nodes
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential