Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
1.14 MB · 1,143,760 B
First seen
2026-08-05 07:45 · 2 months ago
Last seen
2026-08-05 07:45 · 2 months ago
Last analysis
2026-08-05 07:49 · 2 months ago
Hashes
MD5 1c301cf396b2bf57458e057b24e50213 Sha1 6f646db834cf1d9fe8f9cf11b1d5666f77eaff06 Sha256 27d657176b8217b7ac3cf5e38f49b8ff064dcd9fc25759e351ae014b015d35c7 Sha384 d549463b6c255955956e6185b99d20080aeb3666eafff300637d70af83c83a2646184c245fb394e022f79ecd25c0f0fa Sha512 a90c6077a120cb1fde0c4009d42b6668da21883ec6fe4a8aa7b696c5e5184ee97aefb3d464df56bcf0ecbdbd39c54a2410e19545704632dce244834d200c697d SSDeep 24576:gPGPHupaKWEzGZqOALOLs+W9Tz5DHPQTJsvyOP+pBXwW:ARfpLdXNHPwJr17wW TLSH 8035122BFF0C8035F68361F8E21AEB446482355F488574867DAB69BC2F5BB2D97406CD
42 malicious · 250 files
XLS1c301cf396b2bf57458e057b24e50213
XML[Content_Types].xml
BIN_rels
XML.rels
BINcustomXml
XMLitem1.xml
BIN_rels
XMLitem1.xml.rels
XMLitem2.xml.rels
XMLitem3.xml.rels
XMLitem2.xml
XMLitem3.xml
XMLitemProps1.xml
XMLitemProps2.xml
XMLitemProps3.xml
BINdocProps
XMLapp.xml
XMLcore.xml
XMLcustom.xml
BINxl
XMLcalcChain.xml
XMLcomments1.xml
BINctrlProps
XMLctrlProp1.xml
BINdrawings
XMLdrawing1.xml
BIN_rels
XMLdrawing1.xml.rels
XMLdrawing2.xml.rels
XMLdrawing3.xml.rels
XMLdrawing13.xml.rels
XMLdrawing2.xml
XMLdrawing3.xml
XMLdrawing4.xml
XMLdrawing5.xml
XMLdrawing6.xml
XMLdrawing7.xml
XMLdrawing8.xml
XMLdrawing9.xml
XMLdrawing10.xml
XMLdrawing11.xml
XMLdrawing12.xml
XMLdrawing13.xml
VMLvmlDrawing1.vml
VMLvmlDrawing2.vml
VMLvmlDrawing3.vml
VMLvmlDrawing4.vml
VMLvmlDrawing5.vml
VMLvmlDrawing6.vml
VMLvmlDrawing7.vml
VMLvmlDrawing8.vml
VMLvmlDrawing9.vml
VMLvmlDrawing10.vml
VMLvmlDrawing11.vml
VMLvmlDrawing12.vml
BINmedia
IMGimage1.jpeg
IMGimage1.jpeg-preview.png
IMGimage2.jpeg
IMGimage2.jpeg-preview.png
IMGimage3.png
IMGimage3.png-preview.png
IMGimage4.png
IMGimage4.png-preview.png
IMGimage5.png
IMGimage5.png-preview.png
IMGimage6.png
IMGimage6.png-preview.png
IMGimage7.png
IMGimage7.png-preview.png
IMGimage8.png
IMGimage8.png-preview.png
IMGimage9.png
IMGimage9.png-preview.png
IMGimage10.png
IMGimage10.png-preview.png
BINprinterSettings
BINprinterSettings1.bin
BINprinterSettings2.bin
BINprinterSettings7.bin
BINprinterSettings8.bin
BINprinterSettings9.bin
BINprinterSettings10.bin
BINprinterSettings12.bin
XMLsharedStrings.xml
XMLstyles.xml
BINtheme
XMLtheme1.xml
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAHoja2
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja3
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja4
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja5
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja6
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja7
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja8
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja9
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja10
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja11
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja12
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja13
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAmdAesCtr
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
VBAModCapitulo4
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo5
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo6
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo7
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo8
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo9
VBS[Stored VBA]
VBA[PCode]
VBSModEnvioData
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS_VBA_PROJECT
VBS_VBA_PROJECT.deobfuscated.vbs
VBALoginUserForm
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSModValidacion
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
BINLoginUserForm
BINf
BINo
BINCompObj
BINVBFrame
XMLworkbook.xml
BIN_rels
XMLworkbook.xml.rels
BINworksheets
XMLsheet1.xml
BIN_rels
XMLsheet1.xml.rels
OFFsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet4.xml.rels
XMLsheet5.xml.rels
XMLsheet6.xml.rels
XMLsheet7.xml.rels
XMLsheet8.xml.rels
XMLsheet9.xml.rels
XMLsheet10.xml.rels
XMLsheet11.xml.rels
XMLsheet12.xml.rels
XMLsheet13.xml.rels
XMLsheet14.xml.rels
XMLsheet2.xml
XMLsheet3.xml
XMLsheet4.xml
XMLsheet5.xml
XMLsheet6.xml
XMLsheet7.xml
XMLsheet8.xml
XMLsheet9.xml
XMLsheet10.xml
XMLsheet11.xml
XMLsheet12.xml
XMLsheet13.xml
XMLsheet14.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
12 / 12
Path oox:xlsm~T1027~T1059.005>oox:media>img
Shape oox:xlsm>oox:media>img
technique3 nodes
Path oox:xlsm~T1027~T1059.005>bin
Shape oox:xlsm>bin
technique2 nodes
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
42 malicious · 250 files
XLS1c301cf396b2bf57458e057b24e50213
XML[Content_Types].xml
BINxl
XMLcalcChain.xml
XMLcomments1.xml
XMLsharedStrings.xml
XMLstyles.xml
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAHoja2
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja3
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja4
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja5
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja6
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja7
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja8
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja9
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja10
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja11
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja12
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHoja13
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAmdAesCtr
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
VBAModCapitulo4
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo5
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo6
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo7
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo8
VBS[Stored VBA]
VBA[PCode]
VBAModCapitulo9
VBS[Stored VBA]
VBA[PCode]
VBSModEnvioData
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS_VBA_PROJECT
VBS_VBA_PROJECT.deobfuscated.vbs
VBALoginUserForm
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSModValidacion
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
XMLworkbook.xml

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
Hoja2
VBA Macro
Hoja3
VBA Macro
Hoja4
VBA Macro
Hoja5
VBA Macro
Hoja6
VBA Macro
Hoja7
VBA Macro
Hoja8
VBA Macro
Hoja9
VBA Macro
Hoja10
Blacklist VBA
VBA Macro
Hoja11
VBA Macro
Hoja12
VBA Macro
Hoja13
VBA Macro
mdAesCtr
Blacklist VBA
VBA Macro
ModCapitulo4
VBA Macro
ModCapitulo5
VBA Macro
ModCapitulo6
VBA Macro
ModCapitulo7
VBA Macro
ModCapitulo8
VBA Macro
ModCapitulo9
VBA Macro
ThisWorkbook
VBA Macro
LoginUserForm
VBA Macro
No malware configuration was found at this point.
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
1c301cf396b2bf57458e057b24e50213 › xl › worksheets › _rels › sheet2.xml.rels
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
1c301cf396b2bf57458e057b24e50213 › xl › worksheets › _rels › sheet2.xml.rels
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
1c301cf396b2bf57458e057b24e50213 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Decompiled VBA]
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
1c301cf396b2bf57458e057b24e50213 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Decompiled VBA]
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
1c301cf396b2bf57458e057b24e50213 › xl › vbaProject.bin › Root Entry › VBA › ModEnvioData › [Decompiled VBA]
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
1c301cf396b2bf57458e057b24e50213 › xl › vbaProject.bin › Root Entry › VBA › Hoja10 › [Decompiled VBA]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙