Malicious
MS Excel Document
MD5: 1c301cf396b2bf57458e057b24e50213
Size: 1.14 MB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
1.14 MB · 1,143,760 B
First seen
2026-08-05 07:45 · 2 months ago
Last seen
2026-08-05 07:45 · 2 months ago
Last analysis
2026-08-05 07:49 · 2 months ago
Hashes
MD5
1c301cf396b2bf57458e057b24e50213
Sha1
6f646db834cf1d9fe8f9cf11b1d5666f77eaff06
Sha256
27d657176b8217b7ac3cf5e38f49b8ff064dcd9fc25759e351ae014b015d35c7
Sha384
d549463b6c255955956e6185b99d20080aeb3666eafff300637d70af83c83a2646184c245fb394e022f79ecd25c0f0fa
Sha512
a90c6077a120cb1fde0c4009d42b6668da21883ec6fe4a8aa7b696c5e5184ee97aefb3d464df56bcf0ecbdbd39c54a2410e19545704632dce244834d200c697d
SSDeep
24576:gPGPHupaKWEzGZqOALOLs+W9Tz5DHPQTJsvyOP+pBXwW:ARfpLdXNHPwJr17wW
TLSH
8035122BFF0C8035F68361F8E21AEB446482355F488574867DAB69BC2F5BB2D97406CD
42 malicious · 250 files
XLS1c301cf396b2bf57458e057b24e50213T1027 · T1059.005
XML[Content_Types].xml
BIN_rels
BINcustomXml
BINdocProps
BINxl
XMLcalcChain.xml
XMLcomments1.xml
BINctrlProps
BINdrawings
BINmedia
BINprinterSettings
XMLsharedStrings.xml
XMLstyles.xml
BINtheme
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAHoja2
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja3
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja4
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja5
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja6
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja7
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja8
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja9
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja10
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja11
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja12
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja13
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAmdAesCtr
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
VBAModCapitulo4
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModCapitulo5
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModCapitulo6
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModCapitulo7
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModCapitulo8
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModCapitulo9
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSModEnvioData
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECTT1027 · T1059.005
VBS_VBA_PROJECT.deobfuscated.vbsT1059.005
VBALoginUserForm
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSModValidacion
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BINLoginUserForm
XMLworkbook.xml
BIN_rels
BINworksheets
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
12 / 12
Path
oox:xlsm~T1027~T1059.005>oox:media>img
Shape
oox:xlsm>oox:media>img
technique3 nodes
Path
oox:xlsm~T1027~T1059.005>bin
Shape
oox:xlsm>bin
technique2 nodes
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential