Malicious MS Excel Document analysis – 2e2e97570f6e | Malva.RE

Malicious

Share on LinkedIn

MS Excel Document

MD5:

Size: 0 B

application/vnd.ms-excel

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

12 malicious · 105 files

XLS2e2e97570f6ee510fc5fd601ff93d852

XML[Content_Types].xml

BIN_rels

BINxl

BIN_rels

XMLworkbook.xml

XMLstyles.xml

BINworksheets

BINtheme

XMLsharedStrings.xml

OFFvbaProject.bin

BIN.

BINRoot Entry

BINVBA

BINdir

VBAmodAPI

VBASheet1

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBASheet2

VBAModule4

VBAModule5

VBAmodUtil

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

BIN__SRP_4

BIN__SRP_5

BIN__SRP_6

BIN__SRP_7

BIN__SRP_8

BIN__SRP_9

BIN__SRP_a

BIN__SRP_b

BIN__SRP_c

BIN__SRP_d

BIN__SRP_e

BIN__SRP_f

BIN__SRP_12

BIN__SRP_13

BIN__SRP_14

BIN__SRP_15

BIN__SRP_16

BIN__SRP_17

VBAmodUnitTest

VBAThisWorkbook

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

BIN_VBA_PROJECT

VBAJsonConverter

VBAclsWebServices

VBAJsonConverter1

VBAJsonConverter2

VBAJsonConverter3

BINPROJECT

BINPROJECTwm

BINtables

BINdocProps

Config. Field	Value
URL #1	http:/huhuhuhuhuhuhuhuhuhuhu
URL #2	https:huhuhuhuhuhuhuhuhuhuhu
URL #3	http:/huhuhuhuhuhuhuhuhuhuhu
URL #4	https:huhuhuhuhuhuhuhuhuhuhu
URL #5	http:/huhuhuhuhuhuhuhuhuhuhu
URL #6	https:huhuhuhuhuhuhuhuhuhuhu
URL #7	http:/huhuhuhuhuhuhuhuhuhuhu
URL #8	hthuhuhuhu
URL #9	https:huhuhuhuhuhuhuhuhuhuhu
URL #10	http:/huhuhuhuhuhuhuhuhuhuhu
URL #11	https:huhuhuhuhuhuhuhuhuhuhu
URL #12	http:/huhuhuhuhuhuhuhuhuhuhu
URL #13	https:huhuhuhuhuhuhuhuhuhuhu
URL #14	https:huhuhuhuhuhuhuhuhuhuhu
URL #15	http:/huhuhuhuhuhuhuhuhuhuhu
URL #16	https:huhuhuhuhuhuhuhuhuhuhu
URL #17	http:/huhuhuhuhuhuhuhuhuhuhu
URL #18	http:/huhuhuhuhuhuhuhuhuhuhu
URL #19	http:/huhuhuhuhuhuhuhuhuhuhu
URL #20	http:/huhuhuhuhuhuhuhuhuhuhu
URL #21	http:/huhuhuhuhuhuhuhuhuhuhu
URL #22	http:/huhuhuhuhuhuhuhuhuhuhu
URL #23	http:/huhuhuhuhuhuhuhuhuhuhu
URL #24	http:/huhuhuhuhuhuhuhuhuhuhu
URL #25	http:/huhuhuhuhuhuhuhuhuhuhu
URL #26	https:huhuhuhuhuhuhuhuhuhuhu
URL #27	http:/huhuhuhuhuhuhuhuhuhuhu
URL #28	http:/huhuhuhuhuhuhuhuhuhuhu
URL #29	http:/huhuhuhuhuhuhuhuhuhuhu
URL #30	http:/huhuhuhuhuhuhuhuhuhuhu
URL #31	http:/huhuhuhuhuhuhuhuhuhuhu
URL #32	http:/huhuhuhuhuhuhuhuhuhuhu
URL #33	http:/huhuhuhuhuhuhuhuhuhuhu
URL #34	https:huhuhuhuhuhuhuhuhuhuhu
URL #35	http:/huhuhuhuhuhuhuhuhuhuhu
URL #36	https:huhuhuhuhuhuhuhuhuhuhu
URL #37	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL #1	http:/huhuhuhuhuhuhuhuhuhuhu
URL #2	https:huhuhuhuhuhuhuhuhuhuhu
URL #3	http:/huhuhuhuhuhuhuhuhuhuhu
URL #4	https:huhuhuhuhuhuhuhuhuhuhu
URL #5	http:/huhuhuhuhuhuhuhuhuhuhu
URL #6	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL #1	https:huhuhuhuhuhuhuhuhuhuhu
URL #2	http:/huhuhuhuhuhuhuhuhuhuhu
URL #3	http:/huhuhuhuhuhuhuhuhuhuhu
URL #4	http:/huhuhuhuhuhuhuhuhuhuhu
URL #5	https:huhuhuhuhuhuhuhuhuhuhu
URL #6	http:/huhuhuhuhuhuhuhuhuhuhu
URL #7	https:huhuhuhuhuhuhuhuhuhuhu
URL #8	https:huhuhuhuhuhuhuhuhuhuhu
URL #9	http:/huhuhuhuhuhuhuhuhuhuhu
URL #10	https:huhuhuhuhuhuhuhuhuhuhu
URL #11	https:huhuhuhuhuhuhuhuhuhuhu
URL #12	http:/huhuhuhuhuhuhuhuhuhuhu
URL #13	https:huhuhuhuhuhuhuhuhuhuhu
URL #14	http:/huhuhuhuhuhuhuhuhuhuhu
URL #15	http:/huhuhuhuhuhuhuhuhuhuhu
URL #16	http:/huhuhuhuhuhuhuhuhuhuhu
URL #17	http:/huhuhuhuhuhuhuhuhuhuhu
URL #18	http:/huhuhuhuhuhuhuhuhuhuhu
URL #19	http:/huhuhuhuhuhuhuhuhuhuhu
URL #20	http:/huhuhuhuhuhuhuhuhuhuhu
URL #21	http:/huhuhuhuhuhuhuhuhuhuhu
URL #22	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL #1	https:huhuhuhuhuhuhuhuhuhuhu
URL #2	http:/huhuhuhuhuhuhuhuhuhuhu
URL #3	http:/huhuhuhuhuhuhuhuhuhuhu
URL #4	http:/huhuhuhuhuhuhuhuhuhuhu
URL #5	https:huhuhuhuhuhuhuhuhuhuhu
URL #6	http:/huhuhuhuhuhuhuhuhuhuhu
URL #7	https:huhuhuhuhuhuhuhuhuhuhu
URL #8	https:huhuhuhuhuhuhuhuhuhuhu
URL #9	http:/huhuhuhuhuhuhuhuhuhuhu
URL #10	https:huhuhuhuhuhuhuhuhuhuhu
URL #11	https:huhuhuhuhuhuhuhuhuhuhu
URL #12	http:/huhuhuhuhuhuhuhuhuhuhu
URL #13	https:huhuhuhuhuhuhuhuhuhuhu
URL #14	http:/huhuhuhuhuhuhuhuhuhuhu
URL #15	http:/huhuhuhuhuhuhuhuhuhuhu
URL #16	http:/huhuhuhuhuhuhuhuhuhuhu
URL #17	http:/huhuhuhuhuhuhuhuhuhuhu
URL #18	http:/huhuhuhuhuhuhuhuhuhuhu
URL #19	http:/huhuhuhuhuhuhuhuhuhuhu
URL #20	http:/huhuhuhuhuhuhuhuhuhuhu
URL #21	http:/huhuhuhuhuhuhuhuhuhuhu
URL #22	http:/huhuhuhuhuhuhuhuhuhuhu
URL #23	https:huhuhuhuhuhuhuhuhuhuhu
URL #24	https:huhuhuhuhuhuhuhuhuhuhu
URL #25	https:huhuhuhuhuhuhuhuhuhuhu
URL #26	https:huhuhuhuhuhuhuhuhuhuhu
URL #27	https:huhuhuhuhuhuhuhuhuhuhu
URL #28	https:huhuhuhuhuhuhuhuhuhuhu
URL #29	https:huhuhuhuhuhuhuhuhuhuhu
URL #30	https:huhuhuhuhuhuhuhuhuhuhu
URL #31	https:huhuhuhuhuhuhuhuhuhuhu
URL #32	https:huhuhuhuhuhuhuhuhuhuhu
URL #33	https:huhuhuhuhuhuhuhuhuhuhu
URL #34	https:huhuhuhuhuhuhuhuhuhuhu
URL #35	https:huhuhuhuhuhuhuhuhuhuhu
URL #36	https:huhuhuhuhuhuhuhuhuhuhu
URL #37	https:huhuhuhuhuhuhuhuhuhuhu
URL #38	https:huhuhuhuhuhuhuhuhuhuhu
URL #39	https:huhuhuhuhuhuhuhuhuhuhu
URL #40	https:huhuhuhuhuhuhuhuhuhuhu
URL #41	https:huhuhuhuhuhuhuhuhuhuhu
URL #42	https:huhuhuhuhuhuhuhuhuhuhu
URL #43	https:huhuhuhuhuhuhuhuhuhuhu
URL #44	https:huhuhuhuhuhuhuhuhuhuhu
URL #45	https:huhuhuhuhuhuhuhuhuhuhu
URL #46	https:huhuhuhuhuhuhuhuhuhuhu
URL #47	https:huhuhuhuhuhuhuhuhuhuhu
URL #48	https:huhuhuhuhuhuhuhuhuhuhu
URL #49	https:huhuhuhuhuhuhuhuhuhuhu
URL #50	https:huhuhuhuhuhuhuhuhuhuhu
URL #51	https:huhuhuhuhuhuhuhuhuhuhu
URL #52	https:huhuhuhuhuhuhuhuhuhuhu
URL #53	https:huhuhuhuhuhuhuhuhuhuhu
URL #54	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL #1	https:huhuhuhuhuhuhuhuhuhuhu
URL #2	http:/huhuhuhuhuhuhuhuhuhuhu
URL #3	http:/huhuhuhuhuhuhuhuhuhuhu
URL #4	http:/huhuhuhuhuhuhuhuhuhuhu
URL #5	http:/huhuhuhuhuhuhuhuhuhuhu
URL #6	http:/huhuhuhuhuhuhuhuhuhuhu
URL #7	http:/huhuhuhuhuhuhuhuhuhuhu
URL #8	http:/huhuhuhuhuhuhuhuhuhuhu
URL #9	https:huhuhuhuhuhuhuhuhuhuhu
URL #10	http:/huhuhuhuhuhuhuhuhuhuhu
URL #11	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙