Malicious
Malicious

1c301cf396b2bf57458e057b24e50213

Share on LinkedIn
Print
MS Excel Document
MD5: 1c301cf396b2bf57458e057b24e50213
Size: 1.14 MB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 1c301cf396b2bf57458e057b24e50213
Sha1 6f646db834cf1d9fe8f9cf11b1d5666f77eaff06
Sha256 27d657176b8217b7ac3cf5e38f49b8ff064dcd9fc25759e351ae014b015d35c7
Sha384 d549463b6c255955956e6185b99d20080aeb3666eafff300637d70af83c83a2646184c245fb394e022f79ecd25c0f0fa
Sha512 a90c6077a120cb1fde0c4009d42b6668da21883ec6fe4a8aa7b696c5e5184ee97aefb3d464df56bcf0ecbdbd39c54a2410e19545704632dce244834d200c697d
SSDeep 24576:gPGPHupaKWEzGZqOALOLs+W9Tz5DHPQTJsvyOP+pBXwW:ARfpLdXNHPwJr17wW
TLSH 8035122BFF0C8035F68361F8E21AEB446482355F488574867DAB69BC2F5BB2D97406CD
1c301cf396b2bf57458e057b24e50213
Malicious
[Content_Types].xml
_rels
.rels
customXml
item1.xml
_rels
item1.xml.rels
item2.xml.rels
item3.xml.rels
item2.xml
item3.xml
itemProps1.xml
itemProps2.xml
itemProps3.xml
docProps
app.xml
core.xml
custom.xml
xl
calcChain.xml
comments1.xml
ctrlProps
ctrlProp1.xml
drawings
drawing1.xml
_rels
drawing1.xml.rels
drawing2.xml.rels
drawing3.xml.rels
drawing13.xml.rels
drawing2.xml
drawing3.xml
drawing4.xml
drawing5.xml
drawing6.xml
drawing7.xml
drawing8.xml
drawing9.xml
drawing10.xml
drawing11.xml
drawing12.xml
drawing13.xml
vmlDrawing1.vml
vmlDrawing2.vml
vmlDrawing3.vml
vmlDrawing4.vml
vmlDrawing5.vml
vmlDrawing6.vml
vmlDrawing7.vml
vmlDrawing8.vml
vmlDrawing9.vml
vmlDrawing10.vml
vmlDrawing11.vml
vmlDrawing12.vml
media
image1.jpeg
image1.jpeg-preview.png
image2.jpeg
image2.jpeg-preview.png
image3.png
image3.png-preview.png
image4.png
image4.png-preview.png
image5.png
image5.png-preview.png
image6.png
image6.png-preview.png
image7.png
image7.png-preview.png
image8.png
image8.png-preview.png
image9.png
image9.png-preview.png
image10.png
image10.png-preview.png
printerSettings
printerSettings1.bin
printerSettings2.bin
printerSettings7.bin
printerSettings8.bin
printerSettings9.bin
printerSettings10.bin
printerSettings12.bin
sharedStrings.xml
styles.xml
theme
theme1.xml
vbaProject.bin
Root Entry
Malicious
PROJECT
PROJECTwm
VBA
Malicious
dir
Hoja2

Hoja2

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja3

Hoja3

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja4

Hoja4

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja5

Hoja5

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja6

Hoja6

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja7

Hoja7

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja8

Hoja8

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja9

Hoja9

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja10

Hoja10

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja11

Hoja11

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja12

Hoja12

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja13

Hoja13

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
__SRP_0
__SRP_1
__SRP_2
__SRP_3
__SRP_4
__SRP_5
__SRP_6
__SRP_7
__SRP_8
__SRP_9
__SRP_a
__SRP_b
__SRP_c
__SRP_d
__SRP_e
__SRP_f
mdAesCtr

mdAesCtr

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
__SRP_10
__SRP_11
__SRP_12
__SRP_13
__SRP_14
__SRP_15
__SRP_16
__SRP_17
__SRP_18
__SRP_19
__SRP_1a
__SRP_1b
__SRP_1c
__SRP_1d
__SRP_1e
__SRP_1f
__SRP_20
__SRP_21
__SRP_22
__SRP_23
__SRP_24
__SRP_25
__SRP_26
__SRP_27
__SRP_28
__SRP_29
__SRP_2a
__SRP_2b
__SRP_2c
__SRP_2d
ModCapitulo4

ModCapitulo4

[Stored VBA]
Malicious
[PCode]
ModCapitulo5

ModCapitulo5

[Stored VBA]
Malicious
[PCode]
ModCapitulo6

ModCapitulo6

[Stored VBA]
Malicious
[PCode]
ModCapitulo7

ModCapitulo7

[Stored VBA]
Malicious
[PCode]
ModCapitulo8

ModCapitulo8

[Stored VBA]
Malicious
[PCode]
ModCapitulo9

ModCapitulo9

[Stored VBA]
Malicious
[PCode]
ModEnvioData
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
ThisWorkbook

ThisWorkbook

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
_VBA_PROJECT
Malicious
_VBA_PROJECT.deobfuscated.vbs
LoginUserForm

LoginUserForm

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
ModValidacion
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
[Decompiled VBA].deobfuscated.vbs
LoginUserForm
f
o
CompObj
VBFrame
workbook.xml
_rels
workbook.xml.rels
worksheets
sheet1.xml
_rels
sheet1.xml.rels
sheet2.xml.rels
sheet3.xml.rels
sheet4.xml.rels
sheet5.xml.rels
sheet6.xml.rels
sheet7.xml.rels
sheet8.xml.rels
sheet9.xml.rels
sheet10.xml.rels
sheet11.xml.rels
sheet12.xml.rels
sheet13.xml.rels
sheet14.xml.rels
sheet2.xml
sheet3.xml
sheet4.xml
sheet5.xml
sheet6.xml
sheet7.xml
sheet8.xml
sheet9.xml
sheet10.xml
sheet11.xml
sheet12.xml
sheet13.xml
sheet14.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
12 / 12
Path oox:xlsm~T1027~T1059.005>oox:media>img
Shape oox:xlsm>oox:media>img
technique3 nodes
Path oox:xlsm~T1027~T1059.005>bin
Shape oox:xlsm>bin
technique2 nodes
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙