0f86c00cb4be89bd807449a3b611a7b3

MS Excel Document

MD5: 0f86c00cb4be89bd807449a3b611a7b3

Size: 131.49 KB

application/vnd.ms-excel

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

131.49 KB · 131,491 B

First seen

2026-08-05 07:45 · 2 months ago

Last seen

2026-08-05 07:45 · 2 months ago

Last analysis

2026-08-05 07:47 · 2 months ago

Hashes

MD5 0f86c00cb4be89bd807449a3b611a7b3 Sha1 3e4d544b85f256a9410f2d37a5af5c8578c922f0 Sha256 83ba0872c801fa1703efa222709cc30471ab0eacd375a954b5a66ff87edcfbfe Sha384 4d2a9453f6d4652aa0b632490be72d34d239780721fed42cb8f436c23705f9b3e7627b1969a8f1e7b57cc2680389aa02 Sha512 089aeb55f94fe83159350fa93c25a3a059db2e88a5e93555fa1611ddb12b22d99f2319b56a1fa788e93e9a02c63783df6ed52c5ac1bfd78bcdc739315bddf0c1 SSDeep 3072:Y1BfIHuR9JEeS4H492ZfzkP8wIsCsM/QJeQrdi:YHnEeS4a2DsqyBrQ TLSH BED312104041B4E9EFFA563B70CCA6B715002E44A9A9D35E6A05FDBD678DC8F234AB8D

9 malicious · 48 files

XLS0f86c00cb4be89bd807449a3b611a7b3

XML[Content_Types].xml

BIN_rels

XML.rels

BINxl

XMLworkbook.xml

BIN_rels

XMLworkbook.xml.rels

BINworksheets

XMLsheet1.xml

XMLsheet2.xml

XMLsheet3.xml

BIN_rels

XMLsheet2.xml.rels

XMLsheet3.xml.rels

BINtheme

XMLtheme1.xml

XMLstyles.xml

XMLsharedStrings.xml

BINdrawings

XMLdrawing1.xml

VMLvmlDrawing1.vml

XMLdrawing2.xml

VMLvmlDrawing2.vml

BIN_rels

XMLdrawing1.xml.rels

XMLdrawing2.xml.rels

BINmedia

IMGimage1.png

IMGimage1.png-preview.png

IMGimage2.emf

IMGimage2.emf-preview.png

OFFvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

VBAMódulo1

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBA[Full Diff]

VBA[Partial Diff]

VBAMódulo2

VBS[Stored VBA]

VBA[PCode]

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

BIN__SRP_4

BIN__SRP_5

BIN_VBA_PROJECT

XMLcomments1.xml

XMLcomments2.xml

XMLcalcChain.xml

BINdocProps

XMLcore.xml

XMLapp.xml

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

11 / 11

Path oox:xlsm~T1059.005~T1564.007>oox:media>img

Shape oox:xlsm>oox:media>img

malicious 3 nodes

Path oox:xlsm~T1059.005~T1564.007>bin

Shape oox:xlsm>bin

malicious 2 nodes

9 malicious · 48 files

XLS0f86c00cb4be89bd807449a3b611a7b3

XML[Content_Types].xml

BIN_rels

BINxl

XMLworkbook.xml

BIN_rels

BINworksheets

BINtheme

XMLstyles.xml

XMLsharedStrings.xml

BINdrawings

BINmedia

OFFvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

VBAMódulo1

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBA[Full Diff]

VBA[Partial Diff]

VBAMódulo2

VBS[Stored VBA]

VBA[PCode]

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

BIN__SRP_4

BIN__SRP_5

BIN_VBA_PROJECT

XMLcomments1.xml

XMLcomments2.xml

XMLcalcChain.xml

BINdocProps

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	Módulo1	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Módulo2	VBA Macro

No malware configuration was found at this point.