Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 551eae1194b0bc98a58fcd4502b12105
Sha1 03823f0395aab7aff9131bdcd879af01605427b2
Sha256 4f2153a9b63aac4cefe409279abd796823cbb85a54251b5435f359b7891b8b72
Sha384 7ec62af2c322fd6681d01d8e9c88fcd3241875d90795c93f3ce00c341e40469428dcae222c21834cce08c332e516e1c3
Sha512 7463daae890c159f63e1a5a5cd0bccbf8fa8c94de89e639ea8164f62653c1ad861eb212aad01fcd95c8ef24f5447308920c80cb99bd9196df7415a791c65a737
SSDeep 6144:5xEtjPOtioVjZUGGnwfDlavx+Wkg4e2Y5TCtMQU6NyOFp3XSxhu+aHanzriWwxEH:SFCoh3aHazEfN
TLSH CC35E2136544921FCB16B0334EA947AFF7A1AAD29D43332F2E1CF25B7EA56205F025E4
551eae1194b0bc98a58fcd4502b12105
Malicious
Root Entry
Malicious
CompObj
Workbook
SummaryInformation
DocumentSummaryInformation
_VBA_PROJECT_CUR
Malicious
PROJECT
PROJECTwm
VBA
Malicious
dir
Sheet1

Sheet1

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet5

Sheet5

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet6

Sheet6

[Stored VBA]
Malicious
[Stored VBA].deobfuscated.vbs
[PCode]
[Decompiled VBA]
Malicious
[Decompiled VBA].deobfuscated.vbs
Sheet7

Sheet7

[Stored VBA]
Malicious
[Stored VBA].deobfuscated.vbs
[Decompiled VBA]
Malicious
[Decompiled VBA].deobfuscated.vbs
Sheet9

Sheet9

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet11

Sheet11

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
__SRP_0
__SRP_1
__SRP_2
__SRP_3
__SRP_4
__SRP_5
__SRP_6
__SRP_7
__SRP_8
__SRP_9
__SRP_a
__SRP_b
PCS_Macros
Malicious
[Stored VBA]
Malicious
[Stored VBA].deobfuscated.vbs
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Decompiled VBA].deobfuscated.vbs
Malicious
[Full Diff]
Malicious
[Partial Diff]
Malicious
ThisWorkbook

ThisWorkbook

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
_VBA_PROJECT
Malicious
_VBA_PROJECT.deobfuscated.vbs
History_Module

History_Module

[Stored VBA]
Malicious
[PCode]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
7 / 7
Path ole:doc~T1027~T1059.005~T1564.007>bin
Shape ole:doc>bin
malicious 2 nodes
Path ole:doc~T1027~T1059.005~T1564.007>ole:vba
Shape ole:doc>ole:vba
malicious 2 nodes
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
551eae1194b0bc98a58fcd4502b12105
Malicious
Root Entry
Malicious
CompObj
Workbook
SummaryInformation
DocumentSummaryInformation
_VBA_PROJECT_CUR
Malicious
PROJECT
PROJECTwm
VBA
Malicious
dir
Sheet1

Sheet1

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet5

Sheet5

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet6

Sheet6

[Stored VBA]
Malicious
[Stored VBA].deobfuscated.vbs
[PCode]
[Decompiled VBA]
Malicious
[Decompiled VBA].deobfuscated.vbs
Sheet7

Sheet7

[Stored VBA]
Malicious
[Stored VBA].deobfuscated.vbs
[Decompiled VBA]
Malicious
[Decompiled VBA].deobfuscated.vbs
Sheet9

Sheet9

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet11

Sheet11

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
__SRP_0
__SRP_1
__SRP_2
__SRP_3
__SRP_4
__SRP_5
__SRP_6
__SRP_7
__SRP_8
__SRP_9
__SRP_a
__SRP_b
PCS_Macros
Malicious
[Stored VBA]
Malicious
[Stored VBA].deobfuscated.vbs
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Decompiled VBA].deobfuscated.vbs
Malicious
[Full Diff]
Malicious
[Partial Diff]
Malicious
ThisWorkbook

ThisWorkbook

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
_VBA_PROJECT
Malicious
_VBA_PROJECT.deobfuscated.vbs
History_Module

History_Module

[Stored VBA]
Malicious
[PCode]

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
Sheet1
VBA Macro
Sheet5
VBA Macro
Sheet6
VBA Macro
Sheet7
VBA Macro
Sheet9
VBA Macro
Sheet11
VBA Macro
ThisWorkbook
VBA Macro
History_Module
VBA Macro
No malware configuration was found at this point.
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
551eae1194b0bc98a58fcd4502b12105 › Root Entry › _VBA_PROJECT_CUR › VBA › PCS_Macros › [Decompiled VBA]
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
551eae1194b0bc98a58fcd4502b12105 › Root Entry › _VBA_PROJECT_CUR › VBA › PCS_Macros › [Stored VBA]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙