Malicious
551eae1194b0bc98a58fcd4502b12105
MS Office Document
MD5: 551eae1194b0bc98a58fcd4502b12105
Size: 1.16 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
1.16 MB · 1,155,584 B
First seen
2026-09-02 16:00 · one month ago
Last seen
2026-09-02 16:00 · one month ago
Last analysis
2026-09-02 16:00 · one month ago
Hashes
MD5
551eae1194b0bc98a58fcd4502b12105
Sha1
03823f0395aab7aff9131bdcd879af01605427b2
Sha256
4f2153a9b63aac4cefe409279abd796823cbb85a54251b5435f359b7891b8b72
Sha384
7ec62af2c322fd6681d01d8e9c88fcd3241875d90795c93f3ce00c341e40469428dcae222c21834cce08c332e516e1c3
Sha512
7463daae890c159f63e1a5a5cd0bccbf8fa8c94de89e639ea8164f62653c1ad861eb212aad01fcd95c8ef24f5447308920c80cb99bd9196df7415a791c65a737
SSDeep
6144:5xEtjPOtioVjZUGGnwfDlavx+Wkg4e2Y5TCtMQU6NyOFp3XSxhu+aHanzriWwxEH:SFCoh3aHazEfN
TLSH
CC35E2136544921FCB16B0334EA947AFF7A1AAD29D43332F2E1CF25B7EA56205F025E4
25 malicious · 64 files
OFF551eae1194b0bc98a58fcd4502b12105T1027 · T1059.005 · ATT&CK T1564.007
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBASheet1
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBASheet5
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBASheet6
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBASheet7
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBASheet9
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBASheet11
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
VBSPCS_MacrosATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]ATT&CK T1564.007
VBS[Partial Diff]ATT&CK T1564.007
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECTT1027 · T1059.005
VBS_VBA_PROJECT.deobfuscated.vbsT1059.005
VBAHistory_Module
VBS[Stored VBA]T1059.005
VBA[PCode]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
7 / 7
Path
ole:doc~T1027~T1059.005~T1564.007>bin
Shape
ole:doc>bin
malicious
2 nodes
Path
ole:doc~T1027~T1059.005~T1564.007>ole:vba
Shape
ole:doc>ole:vba
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential25 malicious · 64 files
OFF551eae1194b0bc98a58fcd4502b12105T1027 · T1059.005 · ATT&CK T1564.007
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBASheet1
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBASheet5
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBASheet6
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBASheet7
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBASheet9
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBASheet11
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
VBSPCS_MacrosATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]ATT&CK T1564.007
VBS[Partial Diff]ATT&CK T1564.007
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECTT1027 · T1059.005
VBS_VBA_PROJECT.deobfuscated.vbsT1059.005
VBAHistory_Module
VBS[Stored VBA]T1059.005
VBA[PCode]
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
551eae1194b0bc98a58fcd4502b12105 › Root Entry › _VBA_PROJECT_CUR › VBA › PCS_Macros › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
551eae1194b0bc98a58fcd4502b12105 › Root Entry › _VBA_PROJECT_CUR › VBA › PCS_Macros › [Stored VBA]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account