Malicious
MS Office Document
MD5:
Size: 0 B
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
34 malicious · 274 files
OFF3bcca6ff742e681ad317bb6f16b23ec6T1059.005 · ATT&CK T1564.007
BIN[Formulas]
BIN.
BINRoot Entry
BINCompObj
BINWorkbook
BIN_VBA_PROJECT_CUR
BINVBA
BINdir
VBASheet3
VBASheet4
VBASheet6
VBASheet7
VBASheet8
VBASheet9
VBACSHA256ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAModule1ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAModule2
VBAModule3ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBASheet10
VBASheet11
VBASheet12
VBASheet13
VBASheet14ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBASheet15
VBASheet16
VBASheet19
VBASheet20
VBASheet22
VBASheet24
VBASheet27
VBASheet30
VBASheet31
VBASheet33
VBASheet35
VBASheet36
VBASheet41
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
BIN__SRP_38
BIN__SRP_39
BIN__SRP_3a
BIN__SRP_3b
BIN__SRP_3c
BIN__SRP_3d
BIN__SRP_3e
BIN__SRP_3f
BIN__SRP_40
BIN__SRP_41
BIN__SRP_42
BIN__SRP_43
BIN__SRP_44
BIN__SRP_45
BIN__SRP_46
BIN__SRP_47
BIN__SRP_48
BIN__SRP_49
BIN__SRP_4a
BIN__SRP_4b
BIN__SRP_4c
BIN__SRP_4d
BIN__SRP_4e
BIN__SRP_4f
VBAThisWorkbook
BIN_VBA_PROJECT
BINPROJECT
BINPROJECTwm
BINUserForm1
BINSummaryInformation
BINDocumentSummaryInformation
| Config. Field | Value |
|---|---|
| URL #1 | http:/huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential