Deep Malware Analysis of 498419e612ff9ea86d6229cff5aaad55 | md5: 498419e612ff9ea86d6229cff5aaad55 | Office Document | VBA Stomping | ATT&CK T1564.007 | Malicious | Malicious Document | Blacklist VBA | T1059.005 | WScript.Shell | Shell.Application

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	498419e612ff9ea86d6229cff5aaad55
Sha1	c867cc88c868238ceeeecfdc1bc7c849f435870e
Sha256	96c77ffa2af9e9ea86e2b03b8e9e3e8f0514ebec785bec664b5acb137afb0bbe
Sha384	60c829b4e5b6a76aa8369df097bb256849e80a43f8b082371a54fe7a3258a579980c0756e8e68b58fbc481c5852726d3
Sha512	8a1058d3ca1eab1b6f82811b1bebdcf8d7453e7add6781d30938bf2ad46f9849011273dc1b31cbc94376ed132e59eae4c5e441da68f3b9a099361ad537adfd36
SSDeep	12288:QnBcLAoMfSha/vkDwHB/d77UBxZQ51CbAXB/+1CpEHAvc22sD2u:YaEfKEXawxdcBxZAC49I122W2u
TLSH	E9D4231C9674BC6DC31E587CE26E09E1624CBAD26182F21E15C0F68C7367ABB1B8D74D

CSHA256

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

12 / 12

Path oox:xlsm~T1059.005~T1564.007>oox:media>img

Shape oox:xlsm>oox:media>img

malicious 3 nodes

Path oox:xlsm~T1059.005~T1564.007>bin

Shape oox:xlsm>bin

malicious 2 nodes

	Module Name0
	Sheet7	VBA Macro
	CSHA256	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Sheet12	VBA Macro