Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
1.13 MB · 1,131,019 B
First seen
2026-08-04 08:46 · 2 months ago
Last seen
2026-08-04 08:46 · 2 months ago
Last analysis
2026-08-04 08:48 · 2 months ago
Hashes
MD5 100c92c34ffc0cd6832eb72ff0abe0a9 Sha1 6505ef1a0715aef98481d2dc226310e51d6c78de Sha256 13d8c4aac39d22bd39177ede9291d6eb103a2c2de7ccece6f28d6986962d358f Sha384 c0e333e83affedc768d32eea40e5bd6569696afa5311affee6b309067c116777a2cdfe743ddd3beb20932b22ba52b8ab Sha512 8c0e97b128268e595421957d19b83b8990a872bdde41bdaf764d1cb7dea5bc41009dd99b0b66b407c7967f15586643378359f94d781acb16cf45488ce33bcadc SSDeep 24576:FQvnPpaoWEzGZqOALOcsdNomd4OP/Zj0sDJy42Br:Fi3fpLhmd4o/Zj0sFr2J TLSH AE35222EBF0DC437F50352F8B62ACB81D056399E09D5A806387FE1FC079E91D9A4968D
42 malicious · 250 files
XLS100c92c34ffc0cd6832eb72ff0abe0a9
XML[Content_Types].xml
BIN_rels
XML.rels
BINcustomXml
XMLitem1.xml
BIN_rels
XMLitem1.xml.rels
XMLitem2.xml.rels
XMLitem3.xml.rels
XMLitem2.xml
XMLitem3.xml
XMLitemProps1.xml
XMLitemProps2.xml
XMLitemProps3.xml
BINdocProps
XMLapp.xml
XMLcore.xml
XMLcustom.xml
BINxl
XMLcalcChain.xml
XMLcomments1.xml
BINctrlProps
XMLctrlProp1.xml
BINdrawings
XMLdrawing1.xml
BIN_rels
XMLdrawing1.xml.rels
XMLdrawing2.xml.rels
XMLdrawing3.xml.rels
XMLdrawing13.xml.rels
XMLdrawing2.xml
XMLdrawing3.xml
XMLdrawing4.xml
XMLdrawing5.xml
XMLdrawing6.xml
XMLdrawing7.xml
XMLdrawing8.xml
XMLdrawing9.xml
XMLdrawing10.xml
XMLdrawing11.xml
XMLdrawing12.xml
XMLdrawing13.xml
VMLvmlDrawing1.vml
VMLvmlDrawing2.vml
VMLvmlDrawing3.vml
VMLvmlDrawing4.vml
VMLvmlDrawing5.vml
VMLvmlDrawing6.vml
VMLvmlDrawing7.vml
VMLvmlDrawing8.vml
VMLvmlDrawing9.vml
VMLvmlDrawing10.vml
VMLvmlDrawing11.vml
VMLvmlDrawing12.vml
BINmedia
IMGimage1.jpeg
IMGimage1.jpeg-preview.png
IMGimage2.jpeg
IMGimage2.jpeg-preview.png
IMGimage3.png
IMGimage3.png-preview.png
IMGimage4.png
IMGimage4.png-preview.png
IMGimage5.png
IMGimage5.png-preview.png
IMGimage6.png
IMGimage6.png-preview.png
IMGimage7.png
IMGimage7.png-preview.png
IMGimage8.png
IMGimage8.png-preview.png
IMGimage9.png
IMGimage9.png-preview.png
IMGimage10.png
IMGimage10.png-preview.png
BINprinterSettings
BINprinterSettings1.bin
BINprinterSettings2.bin
BINprinterSettings7.bin
BINprinterSettings8.bin
BINprinterSettings9.bin
BINprinterSettings10.bin
BINprinterSettings12.bin
XMLsharedStrings.xml
XMLstyles.xml
BINtheme
XMLtheme1.xml
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAHoja2
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja3
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja4
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja5
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja6
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja7
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja8
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja9
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja10
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja11
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja12
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja13
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAmdAesCtr
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
VBAModCapitulo4
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo5
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo6
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo7
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo8
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo9
VBS[Stored VBA]
VBA[PCode]
VBSModEnvioData
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS_VBA_PROJECT
VBS_VBA_PROJECT.deobfuscated.vbs
VBALoginUserForm
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSModValidacion
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
BINLoginUserForm
BINf
BINo
BINCompObj
BINVBFrame
XMLworkbook.xml
BIN_rels
XMLworkbook.xml.rels
BINworksheets
XMLsheet1.xml
BIN_rels
XMLsheet1.xml.rels
OFFsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet4.xml.rels
XMLsheet5.xml.rels
XMLsheet6.xml.rels
XMLsheet7.xml.rels
XMLsheet8.xml.rels
XMLsheet9.xml.rels
XMLsheet10.xml.rels
XMLsheet11.xml.rels
XMLsheet12.xml.rels
XMLsheet13.xml.rels
XMLsheet14.xml.rels
XMLsheet2.xml
XMLsheet3.xml
XMLsheet4.xml
XMLsheet5.xml
XMLsheet6.xml
XMLsheet7.xml
XMLsheet8.xml
XMLsheet9.xml
XMLsheet10.xml
XMLsheet11.xml
XMLsheet12.xml
XMLsheet13.xml
XMLsheet14.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
12 / 12
Path oox:xlsm~T1027~T1059.005>oox:media>img
Shape oox:xlsm>oox:media>img
technique3 nodes
Path oox:xlsm~T1027~T1059.005>bin
Shape oox:xlsm>bin
technique2 nodes
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
42 malicious · 250 files
XLS100c92c34ffc0cd6832eb72ff0abe0a9
XML[Content_Types].xml
BINxl
XMLcalcChain.xml
XMLcomments1.xml
XMLsharedStrings.xml
XMLstyles.xml
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAHoja2
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja3
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja4
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja5
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja6
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja7
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja8
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja9
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja10
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja11
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja12
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja13
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAmdAesCtr
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
VBAModCapitulo4
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo5
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo6
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo7
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo8
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo9
VBS[Stored VBA]
VBA[PCode]
VBSModEnvioData
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS_VBA_PROJECT
VBS_VBA_PROJECT.deobfuscated.vbs
VBALoginUserForm
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSModValidacion
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
XMLworkbook.xml

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
Hoja2
VBA Macro
Hoja3
VBA Macro
Hoja4
VBA Macro
Hoja5
VBA Macro
Hoja6
VBA Macro
Hoja7
VBA Macro
Hoja8
VBA Macro
Hoja9
VBA Macro
Hoja10
Blacklist VBA
VBA Macro
Hoja11
VBA Macro
Hoja12
VBA Macro
Hoja13
VBA Macro
mdAesCtr
Blacklist VBA
VBA Macro
ModCapitulo4
VBA Macro
ModCapitulo5
VBA Macro
ModCapitulo6
VBA Macro
ModCapitulo7
VBA Macro
ModCapitulo8
VBA Macro
ModCapitulo9
VBA Macro
ThisWorkbook
VBA Macro
LoginUserForm
VBA Macro
No malware configuration was found at this point.
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
100c92c34ffc0cd6832eb72ff0abe0a9 › xl › worksheets › _rels › sheet2.xml.rels
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
100c92c34ffc0cd6832eb72ff0abe0a9 › xl › worksheets › _rels › sheet2.xml.rels
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
100c92c34ffc0cd6832eb72ff0abe0a9 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Decompiled VBA]
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
100c92c34ffc0cd6832eb72ff0abe0a9 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Decompiled VBA]
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
100c92c34ffc0cd6832eb72ff0abe0a9 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Decompiled VBA]
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
100c92c34ffc0cd6832eb72ff0abe0a9 › xl › vbaProject.bin › Root Entry › VBA › Hoja10 › [Decompiled VBA]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙