Malicious
602b7db7fa7f79326a6f3a1f875bd490
MS Excel Document
MD5: 602b7db7fa7f79326a6f3a1f875bd490
Size: 610.16 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
This sample is a 595.9 KB MS Excel Document classified as malicious by Malva.RE. Static analysis extracted 77 embedded or derived files and a malware configuration (Remote Template). It matches 17 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.005 and T1221. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- d5a939a986a7f4fd4889c4b0c4d2daa4788a16b52f958b2a56e912635e519f10
- MD5
- 602b7db7fa7f79326a6f3a1f875bd490
- Verdict
- Malicious
- File type
- MS Excel Document · 595.9 KB
Cite this report: https://app.malva.re/sha256/d5a939a986a7f4fd4889c4b0c4d2daa4788a16b52f958b2a56e912635e519f10
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
610.16 KB · 610,156 B
First seen
2026-09-12 13:15 · one month ago
Last seen
2026-09-12 13:15 · one month ago
Last analysis
2026-09-12 13:15 · one month ago
Hashes
MD5
602b7db7fa7f79326a6f3a1f875bd490
Sha1
0985464447c7acae16caddff60d85e426343db03
Sha256
d5a939a986a7f4fd4889c4b0c4d2daa4788a16b52f958b2a56e912635e519f10
Sha384
474ed9d5e5abe95bc3853773c2c6634d643f358599e65169f4e6567d27423d1617e61d14aa78690a17c8cf5a46be3054
Sha512
4b9c6a138f06a173a5735fef4f75da22ccbcefe5819a70783b797d20e6cb00d56281cca28fc37f7d39f305c47b9931bcfd5b9d52cb448d8e7d527789b548b60a
SSDeep
12288:/BM4hT5Bq+PWNpFwx5/W4GQKgI2iTKaGBU9GwLhT52Y6X+Ywbyf:/BM4hT5kCx5jGQKHeBU9GuhUYxYAg
TLSH
9ED4CF085EEE28D5C78993BED742EE70AB0B8B4D58B2AF5C1A573D152401FB113FAE50
11 malicious · 78 files
XLS602b7db7fa7f79326a6f3a1f875bd490T1027 · T1221 · T1059.005
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
BIN_rels
XMLworkbook.xml.rels
XMLworkbook.xml
BINworksheets
XMLsheet4.xml
XMLsheet3.xml
XMLsheet2.xml
BIN_rels
XMLsheet1.xml.rels
XMLsheet2.xml.rels
XMLsheet3.xml.rels
XMLsheet1.xml
BINmedia
IMGimage5.jpeg
IMGimage5.jpeg-preview.png
IMGimage6.jpeg
IMGimage6.jpeg-preview.png
IMGimage4.jpeg
IMGimage4.jpeg-preview.png
IMGimage2.jpeg
IMGimage2.jpeg-preview.png
IMGimage3.jpeg
IMGimage3.jpeg-preview.png
IMGimage1.jpeg
IMGimage1.jpeg-preview.png
OFFvbaProject.binT1059.005
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBASheet1
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
VBAUserForm1
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECTT1059.005
VBSEmbedPictures_Macros
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBSClear_and_Compress_MacrosT1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
BINUserForm1
BINf
BINo
BINCompObj
BINVBFrame
BINdrawings
BIN_rels
XMLdrawing1.xml.rels
XMLdrawing1.xml
BINtheme
XMLtheme1.xml
XMLstyles.xml
XMLsharedStrings.xml
BINexternalLinks
BIN_rels
OFFexternalLink1.xml.relsT1221
XMLexternalLink1.xml
BINprinterSettings
BINprinterSettings1.bin
BINprinterSettings2.bin
BINprinterSettings3.bin
BINcustomXml
XMLitem2.xml
XMLitem1.xml
BIN_rels
XMLitem1.xml.rels
XMLitem2.xml.rels
XMLitem3.xml.rels
XMLitemProps2.xml
XMLitem3.xml
XMLitemProps3.xml
XMLitemProps1.xml
BINdocProps
XMLapp.xml
XMLcustom.xml
XMLcore.xml
BINdocMetadata
XMLLabelInfo.xml
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
12 / 12
Path
oox:xlsm~T1059.005>oox:media>img
Shape
oox:xlsm>oox:media>img
technique3 nodes
Path
oox:xlsm~T1059.005>bin
Shape
oox:xlsm>bin
technique2 nodes
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential11 malicious · 78 files
XLS602b7db7fa7f79326a6f3a1f875bd490T1027 · T1221 · T1059.005
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
BINworksheets
BINmedia
OFFvbaProject.binT1059.005
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBASheet1
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
VBAUserForm1
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECTT1059.005
VBSEmbedPictures_Macros
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBSClear_and_Compress_MacrosT1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
BINUserForm1
BINdrawings
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
BINexternalLinks
BIN_rels
OFFexternalLink1.xml.relsT1221
XMLexternalLink1.xml
BINprinterSettings
BINcustomXml
BINdocProps
BINdocMetadata
| Config. Field | Value |
|---|---|
| Target | file:/huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious
URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
602b7db7fa7f79326a6f3a1f875bd490 › xl › externalLinks › _rels › externalLink1.xml.rels
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
602b7db7fa7f79326a6f3a1f875bd490 › xl › vbaProject.bin › Root Entry › VBA › Clear_and_Compress_Macros › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
602b7db7fa7f79326a6f3a1f875bd490 › xl › vbaProject.bin › Root Entry › VBA › EmbedPictures_Macros › [Stored VBA]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account