Deep Malware Analysis of 39cc6af95d0425f160571032a6719ad3 | md5: 39cc6af95d0425f160571032a6719ad3 | Office Document | Blacklist VBA | T1059.005 | Scripting.FileSystemObject | DeObfuscated | VBScript | Obfuscated | T1027 | COM Behavior Trace | Moderately Suspicious Document

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	39cc6af95d0425f160571032a6719ad3
Sha1	512920c5e31d08d65940877bdb29d0a17738ce37
Sha256	49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495
Sha384	6ef662102ed63a64c81d59a5fccb030d98ba2e9a38d92e28215a76f23b18e1adf686f2c75a7e8530244d00d39d147720
Sha512	0cc2d31c10d9628b6179c21470ce376724ec59c55f7b1ef54a48699cb451d27b728f6cf6e855c7bebacc7e12fb496ab1aefd0c187aaacd52427e35727bcb50a8
SSDeep	768:LhO+wq8snuiaB3w+rxCNOOa4p4NxllNRJ6DLeBkEuUESPKMU:oq3nuiaB3fAoGMBrJseWEuUESE
TLSH	BB03D07CF558B40AE6928E3C96640BE8F12407C6F231E4AE5506FB9C5B658CB634398D

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 11 STICH kept: 5secondary ignored: 6

bin 1img 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

5 / 5

Path oox:docm>oox:vba~T1027~T1059.005

Shape oox:docm>oox:vba

malicious 2 nodes

Path oox:docm>ole:doc~T1059.005

Shape oox:docm>ole:doc

technique2 nodes

Config. Field	Value
URL (COM trace) #2	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

URLs in VB Code - #2 URIsuspect

httpshuhuhuhuhuhuhu

URLs in VB Code - #4 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #1 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #2 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #3 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #4 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #5 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #6 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 9huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential