Malicious
Malicious

0a32fb4d8ab573dcbbd0da5b61c2b69c

MS Excel Document
MD5: 0a32fb4d8ab573dcbbd0da5b61c2b69c
Size: 2.22 MB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 0a32fb4d8ab573dcbbd0da5b61c2b69c
Sha1 39da89799658efe2d1ca4d5b7a37ce92fabfc857
Sha256 2cdedb9e87b19f3da82e49563e2f3ca9b1e9f4e195a89b2e60e24e380261e2ef
Sha384 da4329942a37feab23ba3f2fb6f1b58d0aadeaee65683b6aa3531b1fc2e1638f81c99d35da58f26eb58f100a47540fdd
Sha512 90740c420ed60674d0372510ccf557942ed8eed57752d035c3aa125a075f97a9e83d4391766a1ff72a3d1413d51ea5668255ccf5f444339927393b39419ebe41
SSDeep 49152:BEm8Us/OhLFTTAaXY2Q27vryTISHyc7229hqpiHP65yhj4SdlO4:f8Us/OpFTTAsQ+zyTISD60E/4hj37O4
TLSH 41A533013D7F6B20D90D01F8968071AAD1164B3EF391A25FBBF3750DE89326F6A4985E
[Content_Types].xml
_rels
.rels
xl
workbook.xml
_rels
workbook.xml.rels
worksheets
sheet1.xml
sheet2.xml
theme
theme1.xml
styles.xml
vbaProject.bin
Root Entry
PROJECT
PROJECTwm
docProps
core.xml
app.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
8 / 8
Path oox:xlsm~T1059.005>bin
Shape oox:xlsm>bin
technique2 nodes
Path oox:xlsm~T1059.005>ole:doc
Shape oox:xlsm>ole:doc
technique2 nodes
[Content_Types].xml
_rels
.rels
xl
workbook.xml
_rels
workbook.xml.rels
worksheets
sheet1.xml
sheet2.xml
theme
theme1.xml
styles.xml
vbaProject.bin
Root Entry
PROJECT
PROJECTwm
docProps
core.xml
app.xml

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
ThisWorkbook
Blacklist VBA
VBA Macro
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙