Malicious
Malicious

21d0170d64be9f25afacf9a7e2c696bc

Share on LinkedIn
Print
MS Excel Document
MD5: 21d0170d64be9f25afacf9a7e2c696bc
Size: 849.37 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
849.37 KB · 849,368 B
First seen
2026-08-07 10:00 · 2 months ago
Last seen
2026-08-07 10:00 · 2 months ago
Last analysis
2026-08-07 10:03 · 2 months ago
Hashes
MD5 21d0170d64be9f25afacf9a7e2c696bc Sha1 8ae31d7eadb1f138f5d32c69ccbb4b04f2a214c7 Sha256 5c6b94f0b8eea8d97c7d5e12c89c8a17a26d679578a79e10687dda3804d5a870 Sha384 86428f178150f484d1fd6408180481b67b5c28982eddd6767d12defca0a1da80f4294d982841f39f9954af1a04d7c89d Sha512 63ded6b1a3d8ec3dd12fa86dfe593ce11d0e118754ce216986cd09eef1712548ecfcc874ce3ad9de153a199698e4429cca6dbb2d5fde8ee04e22b9e16778ecfa SSDeep 12288:YMlMDadzn89+xamtgnZ+xTru0nTlOvch2wacCbPYLuNTiVQJbyvvtffl3caU23X8:BJ5nXMZi/n5Ovch6pJGB9MaUYXe8wn TLSH B205131CFB1694ACCB2B657CC10817D2DC4A59568442B84E1EC4BB443E9A0FBDF8E6BD
62 malicious · 295 files
XLS21d0170d64be9f25afacf9a7e2c696bc
XML[Content_Types].xml
BINxl
XMLworkbook.xml
XMLstyles.xml
XMLsharedStrings.xml
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTlk
BINPROJECTwm
BINVBA
BINdir
VBSReg
VBS[Stored VBA]
VBA[PCode]
VBSReg.deobfuscated.vbs
VBSMain
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAMxNode
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
VBSMxSheet
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAMxUtils
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAfrmAbout
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAfrmError
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
VBAfrmConnOk
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAfrmExport
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAfrmResult
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
VBSfrmWizard
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAMxConfigH
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAMxlConfig
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSfrmRegWarn
VBS[Stored VBA]
VBS[PCode]
VBS[Decompiled VBA]
VBAMxlObjAttr
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAMxNodeAttr
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAfrmProgress
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAfrmPwdInput
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAMxlParseXml
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAfrmTemplates
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSMxlParseJson
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSMxMifService
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Full Diff]
VBS[Full Diff].deobfuscated.vbs
VBA[Partial Diff]
VBS_VBA_PROJECT
VBS_VBA_PROJECT.deobfuscated.vbs
VBAfrmResultQuery
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
VBAConvNodeToSheet
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
VBAConvSheetToNode
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSfrmProgressQuery
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAfrmProgressSynch
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
XMLmetadata.xml
XMLcomments1.xml
XMLcomments2.xml
XMLcalcChain.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
15 / 15
Path oox:xlsm~T1027~T1059.005~T1564.007>oox:media>img
Shape oox:xlsm>oox:media>img
malicious 3 nodes
Path oox:xlsm~T1027~T1059.005~T1564.007>bin
Shape oox:xlsm>bin
malicious 2 nodes
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
fihuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙