Malicious
34b91a4d59a49bc81e8b3c1ae0dd5cf3
VBScript
MD5: 34b91a4d59a49bc81e8b3c1ae0dd5cf3
Size: 1.32 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
1.32 MB · 1,320,448 B
First seen
2026-08-13 11:31 · 2 months ago
Last seen
2026-08-13 11:31 · 2 months ago
Last analysis
2026-08-13 11:35 · 2 months ago
Hashes
MD5
34b91a4d59a49bc81e8b3c1ae0dd5cf3
Sha1
8b2598987d126f90d08e6649405e74f6928c7382
Sha256
014d6318ec453b7c845cfe9b884800797cfb09209b754470fe69603a1d72e454
Sha384
395a205a8fe961f35b79dadda254583f8b9ebc243d65b64a4b82974a0342c36e6a04267673ab441c7af3d0622e48bcfa
Sha512
2554f8cfac2c93b2abc036cf12ccf6a4fb23f060bb67410945d9eee8e23ba2f38d492550e4288e346f87b7005b38c3d2397adc568ce99382ce1a2090abb8527b
SSDeep
24576:yz9yggqk+d7BuiyKe2rYs47FNF3qJjnXwOwIaIKl3pZoml3OIiIulYB1selbaIVG:yU+zwOUu
TLSH
9E55F511F643C62BC69815360CB693F527B4AC492A864B9B325C733D3FFBA90DA47784
66 malicious · 162 files
VBS34b91a4d59a49bc81e8b3c1ae0dd5cf3T1027 · T1059.005 · ATT&CK T1564.007
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSSheet6ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBASheet7
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet8
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet9T1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet9.deobfuscated.vbsT1059.005
VBACSHA256ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBSModule1ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSModule2T1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSModule2.deobfuscated.vbsT1059.005
VBSModule3ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSSheet10
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet11
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBASheet12
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet13
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet14
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet15
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet16
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet18
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet20
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet21
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet36
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
VBSThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
9 / 9
Path
ole:doc~T1027~T1059.005~T1564.007>bin
Shape
ole:doc>bin
malicious
2 nodes
Path
ole:doc~T1027~T1059.005~T1564.007>ole:vba~T1059.005
Shape
ole:doc>ole:vba
malicious
2 nodes
66 malicious · 162 files
VBS34b91a4d59a49bc81e8b3c1ae0dd5cf3T1027 · T1059.005 · ATT&CK T1564.007
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSSheet6ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBASheet7
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet8
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet9T1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet9.deobfuscated.vbsT1059.005
VBACSHA256ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBSModule1ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSModule2T1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSModule2.deobfuscated.vbsT1059.005
VBSModule3ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSSheet10
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet11
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBASheet12
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet13
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet14
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet15
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet16
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet18
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet20
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet21
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet36
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
VBSThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account