Malicious
Malicious

4da972b7c30f42b505f1c97e04a2d3af

Share on LinkedIn
Print
MS Excel Document
MD5: 4da972b7c30f42b505f1c97e04a2d3af
Size: 922.77 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 4da972b7c30f42b505f1c97e04a2d3af
Sha1 467856f3abdf84c5de7a1eef542991dc80f3a7c1
Sha256 d7c8d502f16f7e19756d7d9a80c6bc15e594c305ff6e509aa6d226e71a2d0c47
Sha384 5b3d5261ac75db0b168536419955527518e631ca6c0c36105ce022d266f77b086da99bd6cc154d0437807a898cee0b7c
Sha512 489b28db72d912b3b666c321a23baeeb69fba166c548c5db3271f56f73df89fb13cafd36455115d8b1ec6fe112d2b3e34a88f84157ac930ec0c3a3ea4de59f3a
SSDeep 24576:ZXpzlzTZVETa8BWZ5UZquALfTq/8tG/Yq5yY/4j5:pz0RC9LMwMpyG4j5
TLSH 4E15121ACA4D185BCE7ED3742B3C5BC6540C63898844E86E6144F68CAFD0B4FBB5E66C
4da972b7c30f42b505f1c97e04a2d3af
Malicious
[Content_Types].xml
_rels
.rels
xl
Malicious
workbook.xml
_rels
workbook.xml.rels
worksheets
sheet1.xml
sheet2.xml
sheet3.xml
sheet4.xml
sheet5.xml
sheet6.xml
sheet7.xml
sheet8.xml
sheet9.xml
sheet10.xml
sheet11.xml
sheet12.xml
_rels
sheet1.xml.rels
sheet2.xml.rels
sheet3.xml.rels
sheet4.xml.rels
sheet5.xml.rels
sheet6.xml.rels
sheet8.xml.rels
sheet9.xml.rels
sheet10.xml.rels
sheet11.xml.rels
sheet12.xml.rels
sheet7.xml.rels
theme
theme1.xml
styles.xml
sharedStrings.xml
drawings
drawing1.xml
vmlDrawing7.vml
drawing2.xml
vmlDrawing1.vml
drawing9.xml
vmlDrawing8.vml
vmlDrawing9.vml
drawing11.xml
vmlDrawing10.vml
drawing12.xml
drawing3.xml
vmlDrawing2.vml
drawing4.xml
vmlDrawing3.vml
vmlDrawing11.vml
drawing5.xml
vmlDrawing4.vml
_rels
drawing1.xml.rels
drawing2.xml.rels
drawing6.xml.rels
drawing12.xml.rels
drawing8.xml
drawing6.xml
vmlDrawing5.vml
drawing7.xml
vmlDrawing6.vml
drawing10.xml
media
image1.png
image1.png-preview.png
image2.jpeg
image2.jpeg-preview.png
image3.jpeg
image3.jpeg-preview.png
image4.png
image4.png-preview.png
image6.png
image6.png-preview.png
image5.png
image5.png-preview.png
vbaProject.bin
Malicious
Root Entry
Malicious
PROJECT
PROJECTwm
VBA
Malicious
dir
Hoja2

Hoja2

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja3

Hoja3

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja4

Hoja4

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja5
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja6

Hoja6

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja7
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja8

Hoja8

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja9

Hoja9

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja10

Hoja10

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja11

Hoja11

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Hoja12

Hoja12

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
__SRP_0
__SRP_1
__SRP_2
__SRP_3
__SRP_4
__SRP_5
__SRP_6
__SRP_7
__SRP_8
__SRP_9
__SRP_a
__SRP_b
__SRP_c
__SRP_d
__SRP_e
__SRP_f
mdAesCtr

mdAesCtr

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
__SRP_10
__SRP_11
__SRP_12
__SRP_13
__SRP_14
__SRP_15
__SRP_16
__SRP_17
__SRP_18
__SRP_19
__SRP_1a
__SRP_1b
__SRP_1c
__SRP_1d
__SRP_1e
__SRP_1f
__SRP_20
__SRP_21
__SRP_22
__SRP_23
__SRP_24
__SRP_25
__SRP_26
__SRP_27
__SRP_28
__SRP_29
__SRP_2a
__SRP_2b
__SRP_2c
__SRP_2d
ModHojaC101

ModHojaC101

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
ModHojaC200

ModHojaC200

[Stored VBA]
Malicious
[PCode]
ModHojaC324

ModHojaC324

[Stored VBA]
Malicious
[Stored VBA].deobfuscated.vbs
[PCode]
ModHojaC400

ModHojaC400

[Stored VBA]
Malicious
[PCode]
ModHojaC700

ModHojaC700

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
ModHojaC900

ModHojaC900

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
ModMatrices

ModMatrices

[Stored VBA]
Malicious
[PCode]
ThisWorkbook

ThisWorkbook

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
_VBA_PROJECT
LoginUserForm

LoginUserForm

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
ModEnvioDatos
Malicious
[Stored VBA]
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Full Diff]
Malicious
[Partial Diff]
Malicious
ModValidacion
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
[Decompiled VBA].deobfuscated.vbs
LoginUserForm
f
o
CompObj
VBFrame
printerSettings
printerSettings1.bin
printerSettings2.bin
printerSettings4.bin
printerSettings8.bin
ctrlProps
ctrlProp1.xml
comments1.xml
comments2.xml
calcChain.xml
docProps
core.xml
app.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
14 / 14
Path oox:xlsm~T1027~T1059.005~T1564.007>oox:media>img
Shape oox:xlsm>oox:media>img
malicious 3 nodes
Path oox:xlsm~T1027~T1059.005~T1564.007>bin
Shape oox:xlsm>bin
malicious 2 nodes
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙