Malicious
09dcefea25c0b967f565483921822ab5
MS Office Document
MD5: 09dcefea25c0b967f565483921822ab5
Size: 3.57 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
3.57 MB · 3,565,425 B
Hashes
MD5
09dcefea25c0b967f565483921822ab5
Sha1
baaa9825603dcac31a412e96f9682ae98d1a87df
Sha256
17d5547ebd2e3a9ef610bbee77eb9dbb4955f37f616867b086507c88a56bd219
Sha384
452295706c672aafbe9ff46acf855445acef1700d0df0c29ae2daf52ffcce3fab61e0330c0832e5451354e36a27758be
Sha512
a372dadf4914cc6bfb0669c878e171d6a68c94e50174a29baac1f5e66a3e33e405a842da6f413bb9aa69e4c1a6654670b2452632bf6bfd41a875bfbf7d385698
SSDeep
98304:Aco/a1bgynNaOiJyeFgOLl61aU3h5I2WF1YFK:X82bD4OiJyeFgOLl61aU3h5I2WX
TLSH
C1F56CC3EF440090A818A5F55C93A3E2F896978E7F9FA15F9C45CE14B132039EA5E5CE
50 malicious · 266 files
OFF09dcefea25c0b967f565483921822ab5T1027 · T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.bin.rels
BINworkbook.bin
BINworksheets
BIN_rels
XMLsheet16.bin.rels
XMLsheet1.bin.rels
XMLsheet2.bin.rels
XMLsheet3.bin.rels
XMLsheet4.bin.rels
XMLsheet12.bin.rels
XMLsheet13.bin.rels
XMLsheet14.bin.rels
XMLsheet15.bin.rels
XMLsheet11.bin.rels
XMLsheet10.bin.rels
XMLsheet9.bin.rels
XMLsheet5.bin.rels
XMLsheet6.bin.rels
XMLsheet7.bin.rels
XMLsheet8.bin.rels
BINsheet2.bin
BINsheet1.bin
BINsheet12.bin
BINsheet10.bin
BINsheet6.bin
BINsheet13.bin
BINsheet7.bin
BINsheet9.bin
BINsheet8.bin
BINsheet5.bin
BINsheet14.bin
BINsheet11.bin
BINsheet15.bin
BINsheet3.bin
BINsheet16.bin
BINsheet4.bin
BINbinaryIndex1.bin
BINbinaryIndex16.bin
BINbinaryIndex9.bin
BINbinaryIndex10.bin
BINbinaryIndex7.bin
BINbinaryIndex2.bin
BINbinaryIndex3.bin
BINbinaryIndex4.bin
BINbinaryIndex5.bin
BINbinaryIndex6.bin
BINbinaryIndex8.bin
BINbinaryIndex13.bin
BINbinaryIndex14.bin
BINbinaryIndex15.bin
BINbinaryIndex12.bin
BINbinaryIndex11.bin
BINdrawings
XMLdrawing6.xml
XMLdrawing5.xml
XMLdrawing4.xml
XMLdrawing3.xml
XMLdrawing1.xml
XMLdrawing2.xml
VBSvbaProject.binATT&CK T1564.007
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSTHCLT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSTHCL.deobfuscated.vbsT1059.005
VBSHesoK
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAfrmMST
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSQL_RRT1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSQL_RR.deobfuscated.vbsT1059.005
VBATH_ALL
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSfrmMain
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBSSQL_RRHD
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
BIN__SRP_38
BIN__SRP_39
BIN__SRP_3a
BIN__SRP_3b
BIN__SRP_3c
BIN__SRP_3d
BIN__SRP_3e
BIN__SRP_3f
VBSGhep_fileT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSGhep_file.deobfuscated.vbsT1059.005
VBSDai_dien_PL
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSDownload_TK
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSTH_BK_Master
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
VBSJsonConverterT1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSJsonConverter.deobfuscated.vbsT1059.005
VBSTMS_TrangthaiT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSTMS_Trangthai.deobfuscated.vbsT1059.005
VBSFunction_Token
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSAAA_NATUNG_MAINT1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSAAA_NATUNG_MAIN.deobfuscated.vbsT1059.005
VBSDownload_DetailT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSDownload_Detail.deobfuscated.vbsT1059.005
VBSDownload_Master
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSTMS_thongtinNNT
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBSTH_BK_Master_SQL
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBSUpdate_Chrome_driver
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BINfrmMST
BINf
BINo
BINCompObj
BINVBFrame
BINi01
BINf
BINo
BINCompObj
BINfrmMain
BINf
BINVBFrame
BINi78
BINf
BINo
BINi107
BINf
BINo
BINx
BINCompObj
BINi49
BINf
BINCompObj
BINi184
BINf
BINo
BINi50
BINf
BINi126
BINf
BINo
BINi252
BINf
BINi321
BINf
BINo
BINi359
BINf
BINi361
BINf
BINo
BINi122
BINf
BINo
BINstyles.bin
BINsharedStrings.bin
BINtheme
XMLtheme1.xml
BINcalcChain.bin
BINprinterSettings
BINprinterSettings4.bin
BINprinterSettings3.bin
BINprinterSettings2.bin
BINprinterSettings1.bin
BINprinterSettings5.bin
BINprinterSettings6.bin
BINprinterSettings12.bin
BINprinterSettings11.bin
BINprinterSettings10.bin
BINprinterSettings9.bin
BINdocProps
XMLcore.xml
XMLapp.xml
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
12 / 12
Path
oox:docm~T1027~T1059.005~T1564.007>bin
Shape
oox:docm>bin
malicious
2 nodes
Path
oox:docm~T1027~T1059.005~T1564.007>ole:doc~T1564.007
Shape
oox:docm>ole:doc
malicious
2 nodes
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #9
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #10
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #12
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #13
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #14
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #15
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #16
URIsuspect
htthuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential50 malicious · 266 files
OFF09dcefea25c0b967f565483921822ab5T1027 · T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
BINworkbook.bin
BINworksheets
BINdrawings
VBSvbaProject.binATT&CK T1564.007
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSTHCLT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSTHCL.deobfuscated.vbsT1059.005
VBSHesoK
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAfrmMST
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSQL_RRT1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSQL_RR.deobfuscated.vbsT1059.005
VBATH_ALL
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSfrmMain
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBSSQL_RRHD
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
BIN__SRP_38
BIN__SRP_39
BIN__SRP_3a
BIN__SRP_3b
BIN__SRP_3c
BIN__SRP_3d
BIN__SRP_3e
BIN__SRP_3f
VBSGhep_fileT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSGhep_file.deobfuscated.vbsT1059.005
VBSDai_dien_PL
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSDownload_TK
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSTH_BK_Master
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
VBSJsonConverterT1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSJsonConverter.deobfuscated.vbsT1059.005
VBSTMS_TrangthaiT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSTMS_Trangthai.deobfuscated.vbsT1059.005
VBSFunction_Token
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSAAA_NATUNG_MAINT1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSAAA_NATUNG_MAIN.deobfuscated.vbsT1059.005
VBSDownload_DetailT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSDownload_Detail.deobfuscated.vbsT1059.005
VBSDownload_Master
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSTMS_thongtinNNT
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBSTH_BK_Master_SQL
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBSUpdate_Chrome_driver
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BINfrmMST
BINfrmMain
BINstyles.bin
BINsharedStrings.bin
BINtheme
BINcalcChain.bin
BINprinterSettings
BINdocProps
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › Update_Chrome_driver › [Decompiled VBA]
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › Update_Chrome_driver › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › Download_Master › [Decompiled VBA]
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › Download_Master › [Decompiled VBA]
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › Download_Master › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › Download_Detail › [Decompiled VBA]
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › Download_Detail › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › Download_Detail
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › AAA_NATUNG_MAIN
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › AAA_NATUNG_MAIN
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › Function_Token › [Stored VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #3
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #4
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #5
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #6
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #7
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #8
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #9
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #10
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #11
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #12
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #13
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #14
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #15
URIsuspect
http:/huhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #16
URIsuspect
htthuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › JsonConverter
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › Download_TK › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › HesoK › [Stored VBA]
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
09dcefea25c0b967f565483921822ab5 › xl › vbaProject.bin › Root Entry › VBA › HesoK › [Stored VBA]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account