Deep Malware Analysis of 567e4bc7ccce9fd5ccecf90e1f4454f9 | md5: 567e4bc7ccce9fd5ccecf90e1f4454f9 | Office Document | Blacklist VBA | T1059.005 | Moderately Suspicious Document | Scripting.FileSystemObject | DeObfuscated | VBScript | Obfuscated | T1027 | COM Behavior Trace

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	567e4bc7ccce9fd5ccecf90e1f4454f9
Sha1	cdcfe080fbd8a9492f2df5e61d0ebd9abe41e0d4
Sha256	a92413d4951a28822ec85e5c0d1948d4160b91388c5f3d86504611fc286a4d13
Sha384	4a1e153b0a4b698031034ba7bfd21989107fc4bb371f9e3210517df3ec9b506d09bd1e16960911ac60fe1f19d39ac58b
Sha512	7733321a2da07cf4768454c705b41ea12dbe8565dab9412a2d6fc50d36b89e127908a75269f0c22cfa3276342e0c30725a5f4beb34527ed48995e42e936d7ba7
SSDeep	768:LhO+wq8snuiaB3w+rxCNOOa4p4NxllNRJ6DLeBkEuUESPKMm:oq3nuiaB3fAoGMBrJseWEuUES2
TLSH	E503C07CF158B40AE6928E3D96640BE8F12407C6F231E8FE5606F79C5B658CB634398D

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 11 STICH kept: 5secondary ignored: 6

bin 1img 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

5 / 5

Path oox:docm>oox:vba~T1027~T1059.005

Shape oox:docm>oox:vba

malicious 2 nodes

Path oox:docm>ole:doc~T1059.005

Shape oox:docm>ole:doc

technique2 nodes

Config. Field	Value
URL (COM trace) #2	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

URLs in VB Code - #2 URIsuspect

httpshuhuhuhuhuhuhu

URLs in VB Code - #4 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #1 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #2 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #3 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #4 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #5 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #6 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 9huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential