Malicious
MS Excel Document
MD5:
Size: 0 B
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
50 malicious · 176 files
XLS48d1325ad75a2a4f017e406922183c84T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
BINxl
XMLworkbook.xml
BIN_rels
BINworksheets
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
BINmedia
OFFvbaProject.binATT&CK T1564.007
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBASheet7ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBASheet8
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet9
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBACSHA256ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAModule1ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAModule2
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAModule3ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBASheet14
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet17
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBASheet221
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet222
VBS[Stored VBA]
VBS[Decompiled VBA]
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
VBAThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN_VBA_PROJECT
BINprinterSettings
XMLcalcChain.xml
BINdocProps
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential