Malicious MS Excel Document analysis – 332625b8fe15

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

146 malicious · 558 files

XLS332625b8fe15d576db4f7b1b2ce6b5de

XML[Content_Types].xml

BIN_rels

BINxl

BIN_rels

XMLworkbook.xml

BINworksheets

OFFvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTlk

BINPROJECTwm

BINVBA

BINdir

VBASheet3

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBASheet8

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBASheet11

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBASheet12

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBASheet14

VBS[Stored VBA]

VBS[Decompiled VBA]

VBASheet15

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBASheet18

VBS[Stored VBA]

VBS[Decompiled VBA]

VBASheet19

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBASheet20

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBASheet25

VBS[Stored VBA]

VBS[Decompiled VBA]

VBASheet27

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

BIN__SRP_4

BIN__SRP_5

BIN__SRP_6

BIN__SRP_7

BIN__SRP_8

BIN__SRP_9

BIN__SRP_a

BIN__SRP_b

BIN__SRP_e

BIN__SRP_f

BIN__SRP_10

BIN__SRP_11

BIN__SRP_12

BIN__SRP_13

BIN__SRP_14

BIN__SRP_15

BIN__SRP_16

BIN__SRP_17

BIN__SRP_18

BIN__SRP_19

BIN__SRP_1a

BIN__SRP_1b

BIN__SRP_1c

BIN__SRP_1d

BIN__SRP_1e

BIN__SRP_1f

BIN__SRP_20

BIN__SRP_21

BIN__SRP_22

BIN__SRP_23

BIN__SRP_24

BIN__SRP_25

BIN__SRP_26

BIN__SRP_27

BIN__SRP_28

BIN__SRP_29

BIN__SRP_2a

BIN__SRP_2b

BIN__SRP_2c

BIN__SRP_2d

BIN__SRP_2e

BIN__SRP_2f

BIN__SRP_30

BIN__SRP_31

BIN__SRP_32

BIN__SRP_33

BIN__SRP_34

BIN__SRP_35

BIN__SRP_36

BIN__SRP_37

BIN__SRP_38

BIN__SRP_39

BIN__SRP_3a

BIN__SRP_3b

BIN__SRP_3c

BIN__SRP_3d

BIN__SRP_3e

BIN__SRP_3f

BIN__SRP_40

BIN__SRP_41

BIN__SRP_42

BIN__SRP_43

BIN__SRP_44

BIN__SRP_45

BIN__SRP_46

BIN__SRP_47

BIN__SRP_48

BIN__SRP_49

BIN__SRP_4a

BIN__SRP_4b

BIN__SRP_4c

BIN__SRP_4d

BIN__SRP_4e

BIN__SRP_4f

BIN__SRP_50

BIN__SRP_51

BIN__SRP_52

BIN__SRP_53

BIN__SRP_54

BIN__SRP_55

BIN__SRP_56

BIN__SRP_57

BIN__SRP_58

BIN__SRP_59

BIN__SRP_5a

BIN__SRP_5b

BIN__SRP_5c

BIN__SRP_5d

BIN__SRP_5e

BIN__SRP_5f

BIN__SRP_60

BIN__SRP_61

BIN__SRP_62

BIN__SRP_63

BIN__SRP_64

BIN__SRP_65

BIN__SRP_66

BIN__SRP_67

VBAModuleLic

VBS[Stored VBA]

BIN[Stored VBA].deobfuscated.vbs

SH[Command #0]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

VBAModuleTools

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormDEV

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAFormPreStart

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModuleVerify

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAThisWorkbook

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

BIN_VBA_PROJECT

VBAModuleReports

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule_Common

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Partial Diff]

VBAUserFormBegin

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormStart

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

VBAModule_Corr_24

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule_Corr_26

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule_Corr_27

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormErrors

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBADownload_latest

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModuleImporting

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule_Corr_27E

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule_PreCheck

VBS[Stored VBA]

VBA[PCode]

VBAUserFormeTDSZIP

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormFileFVU

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBAUserFormSaveMap

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormPANCheck

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

VBAUserFormProgress

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormRegister

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule_Process_24

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule_Process_26

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule_Process_27

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormImporting

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBAModuleCreateMaster

VBAUserFormSelectForm

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModuleImportOldData

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBAModule_Process_24Q4

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule_Process_27EQ

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormActiveError

VBS[Stored VBA]

VBS[PCode]

VBS[Decompiled VBA]

VBAModuleCommonGenerate

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormSendingToWeb

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule_Corr_Functions

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormPANCheckStart

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormPreValidation

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormRegisterQuote

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormSelectMapFile

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule_PANVerification

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormSelectDataFile

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormTRACESPANcheck

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModuleCorrection_Common

VBAUserFormRegisterPricing

VBS[Stored VBA]

VBS[PCode]

VBS[Decompiled VBA]

VBAModuleJustificationReport

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormRegisterCheckFail

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAUserFormCheckingforNewVersion

VBS[Stored VBA]

VBS[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBAUserFormRegisterShowComputerID

VBS[Stored VBA]

VBS[PCode]

VBS[Decompiled VBA]

BINUserFormDEV

BINFormPreStart

BINUserFormBegin

BINUserFormStart

BINUserFormErrors

BINUserFormeTDSZIP

BINUserFormFileFVU

BINUserFormSaveMap

BINUserFormPANCheck

BINUserFormProgress

BINUserFormRegister

BINUserFormImporting

BINUserFormSelectForm

BINUserFormActiveError

BINUserFormSendingToWeb

BINUserFormPANCheckStart

BINUserFormPreValidation

BINUserFormRegisterQuote

BINUserFormSelectMapFile

BINUserFormSelectDataFile

BINUserFormTRACESPANcheck

BINUserFormRegisterPricing

BINUserFormRegisterCheckFail

BINUserFormCheckingforNewVersion

BINUserFormRegisterShowComputerID

BINdrawings

BINmedia

XMLsharedStrings.xml

BINtheme

XMLstyles.xml

BINprinterSettings

BINtables

BINctrlProps

BINexternalLinks

BIN_rels

OFFexternalLink1.xml.rels

OFFexternalLink2.xml.rels

XMLexternalLink2.xml

XMLexternalLink1.xml

XMLcalcChain.xml

BINdocProps

Config. Field	Value
Target	file:/huhuhuhuhuhuhuhuhuhuhu
Path	externhuhuhuhuhuhuhu
XPath	/Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML	<Relathuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
Target	file:/huhuhuhuhuhuhuhuhuhuhu
Path	externhuhuhuhuhuhuhu
XPath	/Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML	<Relathuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #4 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #5 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #6 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #7 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #8 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #9 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #10 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #11 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #12 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #13 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #14 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #15 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #16 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #17 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #18 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #19 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #20 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #21 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #22 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #23 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #24 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #25 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #26 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #27 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #28 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #29 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #30 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #31 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #32 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #33 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #34 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

"[Systhuhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhu

Remote Template - Highly Suspicious URImalicious

file:/huhuhuhuhuhuhuhuhuhuhu

Remote Template - Highly Suspicious URImalicious

file:/huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

	Module Name0
	Sheet3	VBA Macro
	Sheet8	VBA Macro
	Sheet11	VBA Macro
	Sheet12	VBA Macro
	Sheet14	VBA Macro
	Sheet15	VBA Macro
	Sheet18	VBA Macro
	Sheet19	VBA Macro
	Sheet20	VBA Macro
	Sheet25	VBA Macro
	Sheet27	VBA Macro
	ModuleLic	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	ModuleTools	VBA Macro
	UserFormDEV	VBA Macro
	FormPreStart	Blacklist VBA VBA Macro
	ModuleVerify	VBA Macro
	ThisWorkbook	Blacklist VBA VBA Macro
	ModuleReports	Blacklist VBA VBA Macro
	Module_Common	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	UserFormBegin	VBA Macro
	UserFormStart	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module_Corr_24	Blacklist VBA VBA Macro
	Module_Corr_26	Blacklist VBA VBA Macro
	Module_Corr_27	Blacklist VBA VBA Macro
	UserFormErrors	VBA Macro
	Download_latest	Blacklist VBA VBA Macro
	ModuleImporting	Blacklist VBA VBA Macro
	Module_Corr_27E	Blacklist VBA VBA Macro
	Module_PreCheck	VBA Macro
	UserFormeTDSZIP	VBA Macro
	UserFormFileFVU	VBA Macro
	UserFormSaveMap	Blacklist VBA VBA Macro
	UserFormPANCheck	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	UserFormProgress	VBA Macro
	UserFormRegister	VBA Macro
	Module_Process_24	Blacklist VBA VBA Macro
	Module_Process_26	Blacklist VBA VBA Macro
	Module_Process_27	Blacklist VBA VBA Macro
	UserFormImporting	VBA Macro
	ModuleCreateMaster	Blacklist VBA VBA Macro
	UserFormSelectForm	VBA Macro
	ModuleImportOldData	VBA Macro
	Module_Process_24Q4	VBA Macro
	Module_Process_27EQ	Blacklist VBA VBA Macro
	UserFormActiveError	VBA Macro
	ModuleCommonGenerate	Blacklist VBA VBA Macro
	UserFormSendingToWeb	Blacklist VBA VBA Macro
	Module_Corr_Functions	VBA Macro
	UserFormPANCheckStart	VBA Macro
	UserFormPreValidation	VBA Macro
	UserFormRegisterQuote	Blacklist VBA VBA Macro
	UserFormSelectMapFile	VBA Macro
	Module_PANVerification	Blacklist VBA VBA Macro
	UserFormSelectDataFile	VBA Macro
	UserFormTRACESPANcheck	VBA Macro
	ModuleCorrection_Common	VBA Macro
	UserFormRegisterPricing	VBA Macro
	ModuleJustificationReport	Blacklist VBA VBA Macro
	UserFormRegisterCheckFail	VBA Macro
	UserFormCheckingforNewVersion	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	UserFormRegisterShowComputerID	VBA Macro