Malicious
MS Office Document
MD5:
Size: 0 B
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
31 malicious · 104 files
OFF40a936721585c1f85d409271994d62e0T1059.005
OFF[Repaired @0x00048749]
BINRoot Entry
BINCompObj
OFFWorkbook
OFF[Repaired @0x00047949]
XML[Content_Types].xml
BIN_rels
BINdrs
BINSummaryInformation
BINDocumentSummaryInformation
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBASheet2
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet3
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
VBAb64Module
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAreadError
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAhashModule
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAmainModule
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBApublicConst
VBS[Stored VBA]
VBA[PCode]
VBAsec18aModule
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAsec18bModule
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAsec18cModule
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAsec18dModule
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN_VBA_PROJECT
VBACommonUtility
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAencryptModule
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAJsonConverter
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBADebuggingModule
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #9
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #10
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #12
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #13
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #14
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #15
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #16
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #17
URIsuspect
http:/huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential