Malicious
4da972b7c30f42b505f1c97e04a2d3af
MS Excel Document
MD5: 4da972b7c30f42b505f1c97e04a2d3af
Size: 922.77 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
922.77 KB · 922,768 B
First seen
2026-08-21 08:15 · 2 months ago
Last seen
2026-08-21 08:15 · 2 months ago
Last analysis
2026-08-21 08:16 · 2 months ago
Hashes
MD5
4da972b7c30f42b505f1c97e04a2d3af
Sha1
467856f3abdf84c5de7a1eef542991dc80f3a7c1
Sha256
d7c8d502f16f7e19756d7d9a80c6bc15e594c305ff6e509aa6d226e71a2d0c47
Sha384
5b3d5261ac75db0b168536419955527518e631ca6c0c36105ce022d266f77b086da99bd6cc154d0437807a898cee0b7c
Sha512
489b28db72d912b3b666c321a23baeeb69fba166c548c5db3271f56f73df89fb13cafd36455115d8b1ec6fe112d2b3e34a88f84157ac930ec0c3a3ea4de59f3a
SSDeep
24576:ZXpzlzTZVETa8BWZ5UZquALfTq/8tG/Yq5yY/4j5:pz0RC9LMwMpyG4j5
TLSH
4E15121ACA4D185BCE7ED3742B3C5BC6540C63898844E86E6144F68CAFD0B4FBB5E66C
48 malicious · 228 files
XLS4da972b7c30f42b505f1c97e04a2d3afT1027 · T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
XMLworkbook.xml
BIN_rels
XMLworkbook.xml.rels
BINworksheets
XMLsheet1.xml
XMLsheet2.xml
XMLsheet3.xml
XMLsheet4.xml
XMLsheet5.xml
XMLsheet6.xml
XMLsheet7.xml
XMLsheet8.xml
XMLsheet9.xml
XMLsheet10.xml
XMLsheet11.xml
XMLsheet12.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet4.xml.rels
XMLsheet5.xml.rels
XMLsheet6.xml.rels
XMLsheet8.xml.rels
OFFsheet9.xml.rels
XMLsheet10.xml.rels
XMLsheet11.xml.rels
XMLsheet12.xml.rels
XMLsheet7.xml.rels
BINtheme
XMLtheme1.xml
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
XMLdrawing1.xml
VMLvmlDrawing7.vml
XMLdrawing2.xml
VMLvmlDrawing1.vml
XMLdrawing9.xml
VMLvmlDrawing8.vml
VMLvmlDrawing9.vml
XMLdrawing11.xml
VMLvmlDrawing10.vml
XMLdrawing12.xml
XMLdrawing3.xml
VMLvmlDrawing2.vml
XMLdrawing4.xml
VMLvmlDrawing3.vml
VMLvmlDrawing11.vml
XMLdrawing5.xml
VMLvmlDrawing4.vml
BIN_rels
XMLdrawing1.xml.rels
XMLdrawing2.xml.rels
XMLdrawing6.xml.rels
XMLdrawing12.xml.rels
XMLdrawing8.xml
XMLdrawing6.xml
VMLvmlDrawing5.vml
XMLdrawing7.xml
VMLvmlDrawing6.vml
XMLdrawing10.xml
BINmedia
IMGimage1.png
IMGimage1.png-preview.png
IMGimage2.jpeg
IMGimage2.jpeg-preview.png
IMGimage3.jpeg
IMGimage3.jpeg-preview.png
IMGimage4.png
IMGimage4.png-preview.png
IMGimage6.png
IMGimage6.png-preview.png
IMGimage5.png
IMGimage5.png-preview.png
VBSvbaProject.binATT&CK T1564.007
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAHoja2
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja3
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja4
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSHoja5
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja6
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSHoja7
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja8
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja9
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja10
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja11
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja12
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAmdAesCtr
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
VBAModHojaC101
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAModHojaC200
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModHojaC324
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAModHojaC400
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModHojaC700
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAModHojaC900
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAModMatrices
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
VBALoginUserForm
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSModEnvioDatosATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBSModValidacion
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BINLoginUserForm
BINf
BINo
BINCompObj
BINVBFrame
BINprinterSettings
BINprinterSettings1.bin
BINprinterSettings2.bin
BINprinterSettings4.bin
BINprinterSettings8.bin
BINctrlProps
XMLctrlProp1.xml
XMLcomments1.xml
XMLcomments2.xml
XMLcalcChain.xml
BINdocProps
XMLcore.xml
XMLapp.xml
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
14 / 14
Path
oox:xlsm~T1027~T1059.005~T1564.007>oox:media>img
Shape
oox:xlsm>oox:media>img
malicious
3 nodes
Path
oox:xlsm~T1027~T1059.005~T1564.007>bin
Shape
oox:xlsm>bin
malicious
2 nodes
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential48 malicious · 228 files
XLS4da972b7c30f42b505f1c97e04a2d3afT1027 · T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
BINxl
XMLworkbook.xml
BIN_rels
BINworksheets
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
BINmedia
VBSvbaProject.binATT&CK T1564.007
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAHoja2
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja3
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja4
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSHoja5
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja6
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSHoja7
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja8
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja9
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja10
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja11
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAHoja12
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAmdAesCtr
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
VBAModHojaC101
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAModHojaC200
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModHojaC324
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAModHojaC400
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModHojaC700
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAModHojaC900
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAModMatrices
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
VBALoginUserForm
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSModEnvioDatosATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBSModValidacion
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BINLoginUserForm
BINprinterSettings
BINctrlProps
XMLcomments1.xml
XMLcomments2.xml
XMLcalcChain.xml
BINdocProps
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
4da972b7c30f42b505f1c97e04a2d3af › xl › vbaProject.bin › Root Entry › VBA › ModEnvioDatos › [Decompiled VBA]
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
4da972b7c30f42b505f1c97e04a2d3af › xl › vbaProject.bin › Root Entry › VBA › ModEnvioDatos › [Decompiled VBA]
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
4da972b7c30f42b505f1c97e04a2d3af › xl › vbaProject.bin › Root Entry › VBA › ModEnvioDatos › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
4da972b7c30f42b505f1c97e04a2d3af › xl › vbaProject.bin › Root Entry › VBA › Hoja8 › [Decompiled VBA]
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
4da972b7c30f42b505f1c97e04a2d3af › xl › worksheets › _rels › sheet9.xml.rels
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account