Deep Malware Analysis of 445c1abbe9291bcb2bb1a954791d5648 | md5: 445c1abbe9291bcb2bb1a954791d5648 | Office Document | Blacklist VBA | T1059.005 | Scripting.FileSystemObject | DeObfuscated | VBScript | Obfuscated | T1027 | COM Behavior Trace

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	445c1abbe9291bcb2bb1a954791d5648
Sha1	1586d0c7da48856c960924715d734e3635b38e2c
Sha256	4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303
Sha384	fe983ad25cf9d537ad27c1756bb118431b73f4c1a3f149311862352c5c6c2f9b8299c695e9340971e3622e6499f951c1
Sha512	2ea9d97c493af046899099a92b2045a34f2d91a7291a3ead8a9cae27a409974d1236ba34ed65ab8a77c5c3bf2f6f8a22971d23b59ffe91aa557bc7deb0faf48f
SSDeep	768:LhGshLXTRJb9ORjH4p4NxllNCiJv9PPB/5eP69eFFo:8sdTzA9YMBMid9nB/kCWi
TLSH	6F13D035DE007815C1A3CA3D71FE19D9F52C0686A23179062795D3DEEBE458B0F16E4B

Module1

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 4secondary ignored: 6

bin 1img 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path oox:docm>oox:vba~T1027~T1059.005

Shape oox:docm>oox:vba

malicious 2 nodes

Path oox:docm>ole:doc~T1059.005

Shape oox:docm>ole:doc

technique2 nodes

Dropped path (COM trace) #1 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #2 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #3 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #4 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #5 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #6 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #7 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

	Module Name0
	Module1	Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.