Malicious
MS Excel Document
MD5: 498419e612ff9ea86d6229cff5aaad55
Size: 626.26 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
626.26 KB · 626,263 B
First seen
2026-08-21 08:15 · 2 months ago
Last seen
2026-08-21 08:15 · 2 months ago
Last analysis
2026-08-21 08:16 · 2 months ago
Hashes
MD5
498419e612ff9ea86d6229cff5aaad55
Sha1
c867cc88c868238ceeeecfdc1bc7c849f435870e
Sha256
96c77ffa2af9e9ea86e2b03b8e9e3e8f0514ebec785bec664b5acb137afb0bbe
Sha384
60c829b4e5b6a76aa8369df097bb256849e80a43f8b082371a54fe7a3258a579980c0756e8e68b58fbc481c5852726d3
Sha512
8a1058d3ca1eab1b6f82811b1bebdcf8d7453e7add6781d30938bf2ad46f9849011273dc1b31cbc94376ed132e59eae4c5e441da68f3b9a099361ad537adfd36
SSDeep
12288:QnBcLAoMfSha/vkDwHB/d77UBxZQ51CbAXB/+1CpEHAvc22sD2u:YaEfKEXawxdcBxZAC49I122W2u
TLSH
E9D4231C9674BC6DC31E587CE26E09E1624CBAD26182F21E15C0F68C7367ABB1B8D74D
58 malicious · 252 files
XLS498419e612ff9ea86d6229cff5aaad55T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
BINxl
XMLworkbook.xml
BIN_rels
BINworksheets
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
BINmedia
VBSvbaProject.binATT&CK T1564.007
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSSheet6ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBASheet7
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet8
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet9
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBACSHA256ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBSModule1ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBSModule2
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSModule3ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBSSheet10
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet11
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBASheet12
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet13
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet14
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet15
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet16
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet18
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet20
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet21
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSSheet36
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
VBSThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
BINprinterSettings
XMLcalcChain.xml
BINctrlProps
BINdocProps
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
12 / 12
Path
oox:xlsm~T1059.005~T1564.007>oox:media>img
Shape
oox:xlsm>oox:media>img
malicious
3 nodes
Path
oox:xlsm~T1059.005~T1564.007>bin
Shape
oox:xlsm>bin
malicious
2 nodes