Malicious
MS Excel Document
MD5: 100c92c34ffc0cd6832eb72ff0abe0a9
Size: 1.13 MB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
1.13 MB · 1,131,019 B
First seen
2026-08-04 08:46 · 2 months ago
Last seen
2026-08-04 08:46 · 2 months ago
Last analysis
2026-08-04 08:48 · 2 months ago
Hashes
MD5
100c92c34ffc0cd6832eb72ff0abe0a9
Sha1
6505ef1a0715aef98481d2dc226310e51d6c78de
Sha256
13d8c4aac39d22bd39177ede9291d6eb103a2c2de7ccece6f28d6986962d358f
Sha384
c0e333e83affedc768d32eea40e5bd6569696afa5311affee6b309067c116777a2cdfe743ddd3beb20932b22ba52b8ab
Sha512
8c0e97b128268e595421957d19b83b8990a872bdde41bdaf764d1cb7dea5bc41009dd99b0b66b407c7967f15586643378359f94d781acb16cf45488ce33bcadc
SSDeep
24576:FQvnPpaoWEzGZqOALOcsdNomd4OP/Zj0sDJy42Br:Fi3fpLhmd4o/Zj0sFr2J
TLSH
AE35222EBF0DC437F50352F8B62ACB81D056399E09D5A806387FE1FC079E91D9A4968D
42 malicious · 250 files
XLS100c92c34ffc0cd6832eb72ff0abe0a9T1027 · T1059.005
XML[Content_Types].xml
BIN_rels
BINcustomXml
BINdocProps
BINxl
XMLcalcChain.xml
XMLcomments1.xml
BINctrlProps
BINdrawings
BINmedia
BINprinterSettings
XMLsharedStrings.xml
XMLstyles.xml
BINtheme
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAHoja2
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja3
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja4
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja5
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja6
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja7
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja8
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja9
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja10
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja11
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja12
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja13
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAmdAesCtr
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
VBAModCapitulo4
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModCapitulo5
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModCapitulo6
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModCapitulo7
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModCapitulo8
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModCapitulo9
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSModEnvioData
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECTT1027 · T1059.005
VBS_VBA_PROJECT.deobfuscated.vbsT1059.005
VBALoginUserForm
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSModValidacion
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BINLoginUserForm
XMLworkbook.xml
BIN_rels
BINworksheets
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
12 / 12
Path
oox:xlsm~T1027~T1059.005>oox:media>img
Shape
oox:xlsm>oox:media>img
technique3 nodes
Path
oox:xlsm~T1027~T1059.005>bin
Shape
oox:xlsm>bin
technique2 nodes
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential