Malicious
MS Excel Document
MD5:
Size: 0 B
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
17 malicious · 49 files
XLSrestreint agenda 1249.ATT&CK T1564.007
BIN.
BINRoot Entry
BINDPB
BINVBA
BINdir
EXEDPB
EXEftrATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbs
EXE[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbs
EXE[Partial Diff]ATT&CK T1564.007
EXEphrATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbs
EXE[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbs
EXE[Partial Diff]ATT&CK T1564.007
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
EXEDistance
EXEProgress
| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | https:huhuhuhuhuhuhu |
| URL #3 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #4 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #6 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #7 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #8 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #9 | https:huhuhuhuhuhuhu |
| URL #10 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #11 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #12 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #13 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #14 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL #15 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential