Malicious
MS Excel Document
MD5: 340172a45c4307d37c0f04730e790f1b
Size: 574.36 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
574.36 KB · 574,355 B
First seen
2026-08-08 17:31 · 2 months ago
Last seen
2026-08-08 17:31 · 2 months ago
Last analysis
2026-08-08 17:33 · 2 months ago
Hashes
MD5
340172a45c4307d37c0f04730e790f1b
Sha1
a2b9a3370c8a5c2a33565ec4c4c33e98d2a01052
Sha256
ded3b318c4b2ed761e6bcb307168ae49dcbfbe9f32a136d6babc131a0f986a2c
Sha384
60da4e8bdfdd94c7bf9801df77c999370bb3a4d772e5ec72f704b74804039861a9259c9e762b0b696e8ae1fb11f3cb3c
Sha512
5e170710d7c0724c0dd24ed7fa30c15fb1ff78109a290bcc6b5b1ac6cf3195a3917dee2791c015b29e6b4e8df977c288b4c1f8aa312bda8837496992363a89d1
SSDeep
12288:4LXSikyQ2BpjhV4GwL4aHoSAWTXS0mfkpmZLW45w05/dg++o:NifQ2Bp1VrDwnIImZLWWdg+t
TLSH
F4C42309C425ED6EDB178538A63D5C72FA012D958341FB7F34A0FA69627E08F43CA89D
49 malicious · 180 files
XLS340172a45c4307d37c0f04730e790f1bT1027 · T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
BINworksheets
VBSvbaProject.binATT&CK T1564.007
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSSheet7ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSSheet8
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet9T1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet9.deobfuscated.vbsT1059.005
VBACSHA256ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBSModule1ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSModule2
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSModule3ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBSSheet14
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBASheet17
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBSSheet221
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet222
VBS[Stored VBA]T1059.005
VBS[Decompiled VBA]T1059.005
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
VBSThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
BINdrawings
BINmedia
XMLstyles.xml
XMLsharedStrings.xml
BINtheme
BINprinterSettings
XMLcalcChain.xml
BINcustomXml
BINdocProps
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
15 / 15
Path
oox:xlsm~T1027~T1059.005~T1564.007>oox:media>img
Shape
oox:xlsm>oox:media>img
malicious
3 nodes
Path
oox:xlsm~T1027~T1059.005~T1564.007>bin
Shape
oox:xlsm>bin
malicious
2 nodes