Malicious
Malicious

185ddd1e558ce1dd791bbb1314f490e4

MS Excel Document
MD5: 185ddd1e558ce1dd791bbb1314f490e4
Size: 178.66 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 185ddd1e558ce1dd791bbb1314f490e4
Sha1 8a2686d3d74963bc528a8e8ce8b26892dd4c8bb1
Sha256 0d39da93c95bc61bf717491072f80ea5e49692ae0537bdfb3829e5875c64bc97
Sha384 d1248592735753fa3d4f43c915792502e1b173b6bafcb2dbf74a66596b6419023f00f61e919fa3ad221731af991bbe0f
Sha512 9e064a41d303504ec302dd071d05e36168b13bfb8a25795913c5a6a8e913c1315bf27ad267cba03f5f652b4cfaffc9c811e2f0aa2602761333b2346226d1c650
SSDeep 3072:MmKCQxgMtst3xO1wsvubsJl6okEAp1amW6ZLEIhTDI:a6Mtsbuv4sJl25pcAT8
TLSH 390412A7987ADDE5EEDC1C39F38DA17694437A988106324FB2E493383361C53758228F
[Content_Types].xml
_rels
.rels
xl
workbook.xml
_rels
workbook.xml.rels
worksheets
sheet1.xml
sheet2.xml
theme
theme1.xml
styles.xml
sharedStrings.xml
vbaProject.bin
Root Entry
PROJECT
PROJECTwm
docProps
core.xml
app.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
8 / 8
Path oox:xlsm~T1059.005>bin
Shape oox:xlsm>bin
technique2 nodes
Path oox:xlsm~T1059.005>ole:doc
Shape oox:xlsm>ole:doc
technique2 nodes
[Content_Types].xml
_rels
.rels
xl
workbook.xml
_rels
workbook.xml.rels
worksheets
sheet1.xml
sheet2.xml
theme
theme1.xml
styles.xml
sharedStrings.xml
vbaProject.bin
Root Entry
PROJECT
PROJECTwm
docProps
core.xml
app.xml

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
ThisWorkbook
Blacklist VBA
VBA Macro
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙