Malicious MS Office Document analysis – 34701048884f

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

22 malicious · 304 files

OFFBrokenText2505

OFF[Repaired @0x000119E8]

BIN[Formulas]

BIN.

BINRoot Entry

BINCompObj

OFFWorkbook

OFF[Repaired @0x000111E8]

BIN_VBA_PROJECT_CUR

BINVBA

BINdir

VBAFrmCD

VBAfrmMap

VBASheet3

VBASheet5

VBASheet6

VBASheet7

VBASheet8

VBAForm16A

VBAfrmMenu

VBAfrmtime

VBAModMain

VBAModTime

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

VBASheet10

VBASheet12

VBASheet13

VBASheet14

VBASheet17

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

BIN__SRP_4

BIN__SRP_5

BIN__SRP_6

BIN__SRP_7

BIN__SRP_8

BIN__SRP_9

BIN__SRP_a

BIN__SRP_b

BIN__SRP_c

BIN__SRP_d

BIN__SRP_e

BIN__SRP_f

VBAModMatch

BIN__SRP_10

BIN__SRP_11

BIN__SRP_12

BIN__SRP_13

BIN__SRP_14

BIN__SRP_15

BIN__SRP_16

BIN__SRP_17

BIN__SRP_18

BIN__SRP_19

BIN__SRP_1a

BIN__SRP_1b

BIN__SRP_1c

BIN__SRP_1d

BIN__SRP_1e

BIN__SRP_1f

BIN__SRP_20

BIN__SRP_21

VBAErrorForm

VBAfrmSplash

VBAModSalary

VBAModVerify

VBAUserForm1

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

VBAfrmWelcome

VBAModChallan

VBAfrmRegister

VBAUserFormPTN

VBAfrmTDSCircle

VBAThisWorkbook

VBAUserFormGovt

BIN_VBA_PROJECT

VBAModExportNew24

VBAModExportNew26

VBAUserFormServer

BINFrmCD

BINfrmMap

BINfrmMenu

BINfrmtime

BINPROJECT

BINErrorForm

BINfrmSplash

BINPROJECTlk

BINPROJECTwm

BINUserForm1

BINfrmWelcome

BINfrmRegister

BINUserFormPTN

BINfrmTDSCircle

BINUserFormGovt

BINUserFormServer

BINSummaryInformation

BINDocumentSummaryInformation

Config. Field	Value
URL #1	https:huhuhuhuhuhuhuhuhuhuhu
URL #2	https:huhuhuhuhuhuhuhuhuhuhu
URL #3	https:huhuhuhuhuhuhuhuhuhuhu
URL #4	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL #1	https:huhuhuhuhuhuhuhuhuhuhu
URL #2	https:huhuhuhuhuhuhuhuhuhuhu
URL #3	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL #1	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

	Module Name0
	FrmCD	VBA Macro
	frmMap	VBA Macro
	Sheet3	VBA Macro
	Sheet5	VBA Macro
	Sheet6	VBA Macro
	Sheet7	VBA Macro
	Sheet8	VBA Macro
	Form16A	Blacklist VBA VBA Macro
	frmMenu	Blacklist VBA VBA Macro
	frmtime	VBA Macro
	ModMain	Blacklist VBA VBA Macro
	ModTime	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Sheet10	VBA Macro
	Sheet12	VBA Macro
	Sheet13	VBA Macro
	Sheet14	VBA Macro
	Sheet17	VBA Macro
	ModMatch	VBA Macro
	ErrorForm	VBA Macro
	frmSplash	VBA Macro
	ModSalary	Blacklist VBA VBA Macro
	ModVerify	VBA Macro
	UserForm1	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	frmWelcome	VBA Macro
	ModChallan	VBA Macro
	frmRegister	Blacklist VBA VBA Macro
	UserFormPTN	VBA Macro
	frmTDSCircle	VBA Macro
	ThisWorkbook	Blacklist VBA VBA Macro
	UserFormGovt	VBA Macro
	ModExportNew24	Blacklist VBA VBA Macro
	ModExportNew26	Blacklist VBA VBA Macro
	UserFormServer	Blacklist VBA VBA Macro