Malicious
Malicious

498419e612ff9ea86d6229cff5aaad55

MS Excel Document
MD5: 498419e612ff9ea86d6229cff5aaad55
Size: 626.26 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
626.26 KB · 626,263 B
First seen
2026-08-21 08:15 · 2 months ago
Last seen
2026-08-21 08:15 · 2 months ago
Last analysis
2026-08-21 08:16 · 2 months ago
Hashes
MD5 498419e612ff9ea86d6229cff5aaad55 Sha1 c867cc88c868238ceeeecfdc1bc7c849f435870e Sha256 96c77ffa2af9e9ea86e2b03b8e9e3e8f0514ebec785bec664b5acb137afb0bbe Sha384 60c829b4e5b6a76aa8369df097bb256849e80a43f8b082371a54fe7a3258a579980c0756e8e68b58fbc481c5852726d3 Sha512 8a1058d3ca1eab1b6f82811b1bebdcf8d7453e7add6781d30938bf2ad46f9849011273dc1b31cbc94376ed132e59eae4c5e441da68f3b9a099361ad537adfd36 SSDeep 12288:QnBcLAoMfSha/vkDwHB/d77UBxZQ51CbAXB/+1CpEHAvc22sD2u:YaEfKEXawxdcBxZAC49I122W2u TLSH E9D4231C9674BC6DC31E587CE26E09E1624CBAD26182F21E15C0F68C7367ABB1B8D74D
58 malicious · 252 files
XLS498419e612ff9ea86d6229cff5aaad55
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
XMLworkbook.xml
BIN_rels
XMLworkbook.xml.rels
BINworksheets
XMLsheet1.xml
XMLsheet2.xml
XMLsheet3.xml
XMLsheet4.xml
XMLsheet5.xml
XMLsheet6.xml
XMLsheet7.xml
XMLsheet8.xml
XMLsheet9.xml
XMLsheet10.xml
XMLsheet11.xml
XMLsheet12.xml
XMLsheet13.xml
XMLsheet14.xml
XMLsheet15.xml
XMLsheet16.xml
XMLsheet17.xml
XMLsheet18.xml
XMLsheet19.xml
XMLsheet20.xml
XMLsheet21.xml
XMLsheet22.xml
XMLsheet23.xml
XMLsheet24.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet3.xml.rels
XMLsheet5.xml.rels
XMLsheet6.xml.rels
XMLsheet7.xml.rels
XMLsheet8.xml.rels
XMLsheet9.xml.rels
XMLsheet10.xml.rels
XMLsheet11.xml.rels
XMLsheet12.xml.rels
XMLsheet14.xml.rels
XMLsheet15.xml.rels
XMLsheet16.xml.rels
XMLsheet17.xml.rels
XMLsheet18.xml.rels
XMLsheet19.xml.rels
XMLsheet20.xml.rels
XMLsheet21.xml.rels
XMLsheet22.xml.rels
XMLsheet13.xml.rels
BINtheme
XMLtheme1.xml
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
XMLdrawing1.xml
BIN_rels
XMLdrawing14.xml.rels
XMLdrawing15.xml.rels
XMLdrawing16.xml.rels
XMLdrawing17.xml.rels
XMLdrawing1.xml.rels
XMLdrawing3.xml.rels
XMLdrawing2.xml
XMLdrawing3.xml
XMLdrawing4.xml
XMLdrawing5.xml
XMLdrawing6.xml
XMLdrawing7.xml
XMLdrawing8.xml
XMLdrawing9.xml
XMLdrawing10.xml
XMLdrawing11.xml
VMLvmlDrawing1.vml
XMLdrawing12.xml
XMLdrawing13.xml
XMLdrawing14.xml
XMLdrawing15.xml
XMLdrawing16.xml
XMLdrawing17.xml
BINmedia
IMGimage1.png
IMGimage1.png-preview.png
IMGimage2.png
IMGimage2.png-preview.png
IMGimage3.png
IMGimage3.png-preview.png
IMGimage4.png
IMGimage4.png-preview.png
IMGimage5.png
IMGimage5.png-preview.png
IMGimage6.png
IMGimage6.png-preview.png
IMGimage7.png
IMGimage7.png-preview.png
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSSheet6
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Full Diff]
VBA[Partial Diff]
VBASheet7
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet8
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet9
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBACSHA256
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Full Diff]
VBA[Partial Diff]
VBSModule1
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Full Diff]
VBA[Partial Diff]
VBSModule2
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSModule3
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Full Diff]
VBA[Partial Diff]
VBSSheet10
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet11
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet12
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet13
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet14
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet15
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet16
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet18
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet20
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet21
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet36
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
VBSThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS_VBA_PROJECT
BINprinterSettings
BINprinterSettings1.bin
BINprinterSettings2.bin
BINprinterSettings3.bin
BINprinterSettings4.bin
BINprinterSettings5.bin
BINprinterSettings8.bin
BINprinterSettings7.bin
BINprinterSettings6.bin
BINprinterSettings9.bin
XMLcalcChain.xml
BINctrlProps
XMLctrlProp1.xml
BINdocProps
XMLcore.xml
XMLapp.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
12 / 12
Path oox:xlsm~T1059.005~T1564.007>oox:media>img
Shape oox:xlsm>oox:media>img
malicious 3 nodes
Path oox:xlsm~T1059.005~T1564.007>bin
Shape oox:xlsm>bin
malicious 2 nodes
58 malicious · 252 files
XLS498419e612ff9ea86d6229cff5aaad55
XML[Content_Types].xml
BINxl
XMLworkbook.xml
XMLstyles.xml
XMLsharedStrings.xml
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSSheet6
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Full Diff]
VBA[Partial Diff]
VBASheet7
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet8
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet9
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBACSHA256
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Full Diff]
VBA[Partial Diff]
VBSModule1
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Full Diff]
VBA[Partial Diff]
VBSModule2
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSModule3
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Full Diff]
VBA[Partial Diff]
VBSSheet10
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet11
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet12
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet13
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet14
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet15
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet16
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet18
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet20
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet21
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSheet36
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
VBSThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS_VBA_PROJECT
XMLcalcChain.xml

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
Sheet7
VBA Macro
CSHA256
VBA Stomping
ATT&CK T1564.007
Malicious
Malicious Document
VBA Macro

Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis.

VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams.

To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective.

This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.

Sheet12
VBA Macro
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙