Malicious MS Excel Document analysis – 459a8eb5c77c

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

50 malicious · 225 files

XLS459a8eb5c77c6a257e9349246b18c664

XML[Content_Types].xml

BIN_rels

BINxl

XMLworkbook.xml

BIN_rels

BINworksheets

BINtheme

XMLstyles.xml

XMLsharedStrings.xml

OFFvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTlk

BINPROJECTwm

BINVBA

BINdir

VBASheet1

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBASheet2

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAbneMain

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

BIN__SRP_4

BIN__SRP_5

BIN__SRP_6

BIN__SRP_7

BIN__SRP_8

BIN__SRP_9

BIN__SRP_a

BIN__SRP_b

BIN__SRP_c

BIN__SRP_d

BIN__SRP_e

BIN__SRP_f

BIN__SRP_10

BIN__SRP_11

BIN__SRP_12

BIN__SRP_13

BIN__SRP_14

BIN__SRP_15

BIN__SRP_16

BIN__SRP_17

BIN__SRP_18

BIN__SRP_19

BIN__SRP_1a

BIN__SRP_1b

BIN__SRP_1c

BIN__SRP_1d

BIN__SRP_1e

BIN__SRP_1f

BIN__SRP_20

BIN__SRP_21

BIN__SRP_22

BIN__SRP_23

BIN__SRP_24

BIN__SRP_25

VBABneLayout

VBABneBrowser

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

VBABneVBAGraph

VBAbneMsgLogger

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBABneVBAGraphs

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAThisWorkbook

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

BIN_VBA_PROJECT

VBABneVBAMessage

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBA[Partial Diff]

VBABneLayoutBlock

VBAbneRibbonUtils

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBABneVBAMessages

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBABneVBAProperty

VBABneVBAUploader

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBABneLayoutColumn

VBABneSummarySheet

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBABneVBAParameter

VBAbneReadOnlyUtils

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBABneVBAParameters

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBABneVBAProperties

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBABneUploadSettings

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBABneVBAInterfaceCol

VBABneDownloadHTTPHandler

BINBneBrowser

BINBneUploadSettings

BINdrawings

BINmedia

BINprinterSettings

XMLcomments1.xml

XMLcalcChain.xml

BINcustomXml

BINdocProps

BINcustomUI

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

	Module Name0
	Sheet1	Blacklist VBA VBA Macro
	Sheet2	VBA Macro
	bneMain	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	BneLayout	VBA Macro
	BneBrowser	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	BneVBAGraph	VBA Macro
	bneMsgLogger	VBA Macro
	BneVBAGraphs	VBA Macro
	ThisWorkbook	Blacklist VBA VBA Macro
	BneVBAMessage	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	BneLayoutBlock	VBA Macro
	bneRibbonUtils	Blacklist VBA VBA Macro
	BneVBAMessages	VBA Macro
	BneVBAProperty	VBA Macro
	BneVBAUploader	Blacklist VBA VBA Macro
	BneLayoutColumn	VBA Macro
	BneSummarySheet	VBA Macro
	BneVBAParameter	VBA Macro
	bneReadOnlyUtils	VBA Macro
	BneVBAParameters	VBA Macro
	BneVBAProperties	VBA Macro
	BneUploadSettings	Blacklist VBA VBA Macro
	BneVBAInterfaceCol	VBA Macro
	BneDownloadHTTPHandler	VBA Macro