Malicious
MS Office Document
MD5: 09dcefea25c0b967f565483921822ab5
Size: 3.57 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
3.57 MB · 3,565,425 B
First seen
2026-07-21 06:31 · 3 months ago
Last seen
2026-07-21 06:31 · 3 months ago
Last analysis
2026-07-21 13:47 · 3 months ago
Hashes
MD5
09dcefea25c0b967f565483921822ab5
Sha1
baaa9825603dcac31a412e96f9682ae98d1a87df
Sha256
17d5547ebd2e3a9ef610bbee77eb9dbb4955f37f616867b086507c88a56bd219
Sha384
452295706c672aafbe9ff46acf855445acef1700d0df0c29ae2daf52ffcce3fab61e0330c0832e5451354e36a27758be
Sha512
a372dadf4914cc6bfb0669c878e171d6a68c94e50174a29baac1f5e66a3e33e405a842da6f413bb9aa69e4c1a6654670b2452632bf6bfd41a875bfbf7d385698
SSDeep
98304:Aco/a1bgynNaOiJyeFgOLl61aU3h5I2WF1YFK:X82bD4OiJyeFgOLl61aU3h5I2WX
TLSH
C1F56CC3EF440090A818A5F55C93A3E2F896978E7F9FA15F9C45CE14B132039EA5E5CE
50 malicious · 266 files
OFF09dcefea25c0b967f565483921822ab5T1027 · T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
BINworkbook.bin
BINworksheets
BINdrawings
VBSvbaProject.binATT&CK T1564.007
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSTHCLT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSTHCL.deobfuscated.vbsT1059.005
VBSHesoK
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAfrmMST
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSQL_RRT1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSQL_RR.deobfuscated.vbsT1059.005
VBATH_ALL
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSfrmMain
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBSSQL_RRHD
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
BIN__SRP_38
BIN__SRP_39
BIN__SRP_3a
BIN__SRP_3b
BIN__SRP_3c
BIN__SRP_3d
BIN__SRP_3e
BIN__SRP_3f
VBSGhep_fileT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSGhep_file.deobfuscated.vbsT1059.005
VBSDai_dien_PL
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSDownload_TK
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSTH_BK_Master
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
VBSJsonConverterT1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSJsonConverter.deobfuscated.vbsT1059.005
VBSTMS_TrangthaiT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSTMS_Trangthai.deobfuscated.vbsT1059.005
VBSFunction_Token
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSAAA_NATUNG_MAINT1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSAAA_NATUNG_MAIN.deobfuscated.vbsT1059.005
VBSDownload_DetailT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSDownload_Detail.deobfuscated.vbsT1059.005
VBSDownload_Master
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSTMS_thongtinNNT
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBSTH_BK_Master_SQL
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBSUpdate_Chrome_driver
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BINfrmMST
BINfrmMain
BINstyles.bin
BINsharedStrings.bin
BINtheme
BINcalcChain.bin
BINprinterSettings
BINdocProps
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
12 / 12
Path
oox:docm~T1027~T1059.005~T1564.007>bin
Shape
oox:docm>bin
malicious
2 nodes
Path
oox:docm~T1027~T1059.005~T1564.007>ole:doc~T1564.007
Shape
oox:docm>ole:doc
malicious
2 nodes
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #9
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #10
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #12
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #13
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #14
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #15
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #16
URIsuspect
htthuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential