Malicious
21d0170d64be9f25afacf9a7e2c696bc
MS Excel Document
MD5: 21d0170d64be9f25afacf9a7e2c696bc
Size: 849.37 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
849.37 KB · 849,368 B
First seen
2026-08-07 10:00 · 2 months ago
Last seen
2026-08-07 10:00 · 2 months ago
Last analysis
2026-08-07 10:03 · 2 months ago
Hashes
MD5
21d0170d64be9f25afacf9a7e2c696bc
Sha1
8ae31d7eadb1f138f5d32c69ccbb4b04f2a214c7
Sha256
5c6b94f0b8eea8d97c7d5e12c89c8a17a26d679578a79e10687dda3804d5a870
Sha384
86428f178150f484d1fd6408180481b67b5c28982eddd6767d12defca0a1da80f4294d982841f39f9954af1a04d7c89d
Sha512
63ded6b1a3d8ec3dd12fa86dfe593ce11d0e118754ce216986cd09eef1712548ecfcc874ce3ad9de153a199698e4429cca6dbb2d5fde8ee04e22b9e16778ecfa
SSDeep
12288:YMlMDadzn89+xamtgnZ+xTru0nTlOvch2wacCbPYLuNTiVQJbyvvtffl3caU23X8:BJ5nXMZi/n5Ovch6pJGB9MaUYXe8wn
TLSH
B205131CFB1694ACCB2B657CC10817D2DC4A59568442B84E1EC4BB443E9A0FBDF8E6BD
62 malicious · 295 files
XLS21d0170d64be9f25afacf9a7e2c696bcT1027 · T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
XMLworkbook.xml
BIN_rels
XMLworkbook.xml.rels
BINworksheets
XMLsheet1.xml
XMLsheet2.xml
XMLsheet3.xml
XMLsheet4.xml
XMLsheet5.xml
XMLsheet6.xml
XMLsheet7.xml
XMLsheet8.xml
XMLsheet9.xml
XMLsheet10.xml
XMLsheet11.xml
XMLsheet12.xml
XMLsheet13.xml
XMLsheet14.xml
XMLsheet15.xml
XMLsheet16.xml
XMLsheet17.xml
XMLsheet18.xml
XMLsheet19.xml
XMLsheet20.xml
XMLsheet21.xml
XMLsheet22.xml
XMLsheet23.xml
XMLsheet24.xml
XMLsheet25.xml
XMLsheet26.xml
XMLsheet27.xml
XMLsheet28.xml
BIN_rels
XMLsheet12.xml.rels
XMLsheet13.xml.rels
XMLsheet14.xml.rels
XMLsheet15.xml.rels
XMLsheet16.xml.rels
XMLsheet17.xml.rels
XMLsheet19.xml.rels
XMLsheet20.xml.rels
XMLsheet21.xml.rels
XMLsheet22.xml.rels
XMLsheet23.xml.rels
XMLsheet24.xml.rels
XMLsheet25.xml.rels
XMLsheet26.xml.rels
XMLsheet27.xml.rels
XMLsheet28.xml.rels
XMLsheet18.xml.rels
XMLsheet3.xml.rels
OFFsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet4.xml.rels
XMLsheet5.xml.rels
XMLsheet6.xml.rels
XMLsheet7.xml.rels
XMLsheet8.xml.rels
XMLsheet9.xml.rels
XMLsheet10.xml.rels
XMLsheet11.xml.rels
BINtheme
XMLtheme1.xml
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
XMLdrawing1.xml
VMLvmlDrawing1.vml
XMLdrawing2.xml
VMLvmlDrawing2.vml
VMLvmlDrawing3.vml
BIN_rels
XMLdrawing2.xml.rels
BINmedia
IMGimage1.png
IMGimage1.png-preview.png
VBSvbaProject.binATT&CK T1564.007
BINRoot Entry
BINPROJECT
BINPROJECTlk
BINPROJECTwm
BINVBA
BINdir
VBSRegT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSReg.deobfuscated.vbsT1059.005
VBSMain
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxNode
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSMxSheet
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxUtils
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAfrmAbout
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmError
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAfrmConnOk
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmExport
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmResult
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSfrmWizard
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxConfigH
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlConfig
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlLogger
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSfrmRegWarn
VBS[Stored VBA]T1059.005
VBS[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlObjAttr
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxNodeAttr
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmProgress
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmPwdInput
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlParseXml
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlPropFile
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAfrmTemplates
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSMxlParseJson
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSMxMifServiceATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBS_VBA_PROJECTT1027 · T1059.005
VBS_VBA_PROJECT.deobfuscated.vbsT1059.005
VBAfrmResultQuery
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAConvNodeToSheet
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAConvSheetToNode
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSfrmProgressQuery
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmProgressSynch
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BINfrmAbout
BINf
BINo
BINCompObj
BINVBFrame
BINfrmError
BINf
BINo
BINVBFrame
BINfrmConnOk
BINf
BINo
BINVBFrame
BINfrmExport
BINf
BINo
BINVBFrame
BINfrmResult
BINf
BINo
BINVBFrame
BINfrmWizard
BINf
BINo
BINVBFrame
BINfrmRegWarn
BINf
BINo
BINVBFrame
BINfrmProgress
BINf
BINo
BINVBFrame
BINi04
BINf
BINo
BINCompObj
BINi12
BINf
BINfrmPwdInput
BINf
BINo
BINVBFrame
BINfrmTemplates
BINf
BINo
BINVBFrame
BINfrmResultQuery
BINf
BINo
BINVBFrame
BINfrmProgressQuery
BINf
BINo
BINVBFrame
BINi21
BINf
BINfrmProgressSynch
BINf
BINo
BINVBFrame
BINi04
BINf
BINi05
BINf
XMLmetadata.xml
BINprinterSettings
BINprinterSettings1.bin
BINprinterSettings10.bin
BINctrlProps
XMLctrlProp1.xml
XMLcomments1.xml
XMLcomments2.xml
BINtables
XMLtable1.xml
XMLcalcChain.xml
BINcustomXml
XMLitem1.xml
XMLitemProps1.xml
XMLitem2.xml
XMLitemProps2.xml
XMLitem3.xml
XMLitemProps3.xml
BIN_rels
XMLitem1.xml.rels
XMLitem2.xml.rels
XMLitem3.xml.rels
BINdocMetadata
XMLLabelInfo.xml
BINdocProps
XMLcore.xml
XMLapp.xml
XMLcustom.xml
BINuserCustomization
XMLcustomUI.xml
BINcustomUI
XMLcustomUI.xml
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
15 / 15
Path
oox:xlsm~T1027~T1059.005~T1564.007>oox:media>img
Shape
oox:xlsm>oox:media>img
malicious
3 nodes
Path
oox:xlsm~T1027~T1059.005~T1564.007>bin
Shape
oox:xlsm>bin
malicious
2 nodes
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
fihuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential62 malicious · 295 files
XLS21d0170d64be9f25afacf9a7e2c696bcT1027 · T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
BINxl
XMLworkbook.xml
BIN_rels
BINworksheets
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
BINmedia
VBSvbaProject.binATT&CK T1564.007
BINRoot Entry
BINPROJECT
BINPROJECTlk
BINPROJECTwm
BINVBA
BINdir
VBSRegT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSReg.deobfuscated.vbsT1059.005
VBSMain
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxNode
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSMxSheet
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxUtils
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAfrmAbout
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmError
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAfrmConnOk
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmExport
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmResult
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSfrmWizard
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxConfigH
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlConfig
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlLogger
VBSfrmRegWarn
VBS[Stored VBA]T1059.005
VBS[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlObjAttr
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxNodeAttr
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmProgress
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmPwdInput
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlParseXml
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlPropFile
VBAfrmTemplates
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSMxlParseJson
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSMxMifServiceATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBS_VBA_PROJECTT1027 · T1059.005
VBS_VBA_PROJECT.deobfuscated.vbsT1059.005
VBAfrmResultQuery
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAConvNodeToSheet
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAConvSheetToNode
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSfrmProgressQuery
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmProgressSynch
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BINfrmAbout
BINfrmError
BINfrmConnOk
BINfrmExport
BINfrmResult
BINfrmWizard
BINfrmRegWarn
BINfrmProgress
BINfrmPwdInput
BINfrmTemplates
BINfrmResultQuery
BINfrmProgressQuery
BINfrmProgressSynch
XMLmetadata.xml
BINprinterSettings
BINctrlProps
XMLcomments1.xml
XMLcomments2.xml
BINtables
XMLcalcChain.xml
BINcustomXml
BINdocMetadata
BINdocProps
BINuserCustomization
BINcustomUI
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › vbaProject.bin › Root Entry › VBA › MxMifService › [Full Diff]
URLs in VB Code - #1
URIsuspect
fihuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › vbaProject.bin › Root Entry › VBA › MxNodeAttr › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › vbaProject.bin › Root Entry › VBA › frmRegWarn › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › vbaProject.bin › Root Entry › VBA › frmError › [Decompiled VBA]
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › vbaProject.bin › Root Entry › VBA › frmError › [Decompiled VBA]
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Decompiled VBA]
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Decompiled VBA]
URLs in VB Code - #4
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Decompiled VBA]
URLs in VB Code - #5
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › vbaProject.bin › Root Entry › VBA › Main › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › vbaProject.bin › Root Entry › VBA › Reg
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › worksheets › _rels › sheet1.xml.rels
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › worksheets › _rels › sheet1.xml.rels
Remote Resource Reference
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › worksheets › _rels › sheet1.xml.rels
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
21d0170d64be9f25afacf9a7e2c696bc › xl › worksheets › _rels › sheet1.xml.rels
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account