Malicious
MS Office Document
MD5:
Size: 0 B
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
The file 3e74d1989d893294e6db22bc7b4ce378 is a MS Office Document for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 406 embedded or derived files. It matches 327 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- —
- MD5
- -
- Verdict
- Malicious
- File type
- MS Office Document
- MITRE ATT&CK
- T1059.005
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
203 malicious · 407 files
OFF3e74d1989d893294e6db22bc7b4ce378T1059.005 · ATT&CK T1564.007
BINRoot Entry
BINData
BIN1Table
BINCompObj
BINWordDocument
BINSummaryInformation
BINDocumentSummaryInformation
BINMacros
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAArea
VBAbillATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBAkeys
VBS[Stored VBA]
VBA[PCode]
VBAMAIN
VBAmemo
VBAoyez
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAsaveATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBATodo
VBS[Stored VBA]
VBS[PCode]
VBAAdams
VBS[Stored VBA]
VBA[PCode]
VBAcall_
VBS[Stored VBA]
VBA[PCode]
VBAdiary
VBAdraft
VBS[Stored VBA]
VBA[PCode]
VBAmerge
VBS[Stored VBA]
VBA[PCode]
VBApause
VBS[Stored VBA]
VBA[PCode]
VBAStart
VBAccsaveATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBAClass1
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBADebug_
VBAFooter
VBALetter
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAourref
VBAprint_ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBAwisdom
VBAaddress
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAavdbupd
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAcallall
VBAClauses
VBS[Stored VBA]
VBA[PCode]
VBAdevelop
VBS[Stored VBA]
VBA[PCode]
VBAdoctype
VBAFEENAME
VBAoffice1ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBARecover
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAtestdoc
VBAupdate_ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBAwisclseATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBAwisprocATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBAwistestATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBAAutoMenu
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAAutoType
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAChangeFE
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBADocument
VBAEditDACS
VBS[Stored VBA]
VBA[PCode]
VBAenvelope
VBAfaxcover
VBAfileinfo
VBAfontlist
VBAmacrodoc
VBAMailMerg
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAnewprint
VBS[Stored VBA]
VBA[PCode]
VBAoyezformATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBAPersonalATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBApreccall
VBS[Stored VBA]
VBA[PCode]
VBAprintallATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBS[Partial Diff]ATT&CK T1564.007
VBASolMerge
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAstopcodeATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBAtodoview
VBS[Stored VBA]
VBA[PCode]
VBATransfer
VBAwriteini
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAavdbupdv2
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAcheckdate
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAcreatedoc
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAdatabase_ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBAdiaryview
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBALocalDACS
VBANewMacros
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBANewScreenATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBAprcdblink
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAprecedentATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBAtelephone
VBATemplates
VBAUserForm1
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAUserForm2
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAUserForm3
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAUserForm4
VBS[Stored VBA]
VBS[Decompiled VBA]
VBAUserForm5
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAUtilities
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAwatermark
VBS[Stored VBA]
VBA[PCode]
VBAwisdomdllATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBS[Partial Diff]ATT&CK T1564.007
VBAAssignKeys
VBS[Stored VBA]
VBA[PCode]
VBAattendance
VBAAutomation
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAClientName
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBACreateWork
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAdacsinichk
VBS[Stored VBA]
VBA[PCode]
VBADiaryEntry
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAdiaryprint
VBS[Stored VBA]
VBA[PCode]
VBAduplextest
VBS[Stored VBA]
VBA[PCode]
VBAFinn_Busby
VBS[Stored VBA]
VBA[PCode]