Malicious
661d2f5c01ef75340afbecd7e9e53ac2
MS Excel Document
MD5: 661d2f5c01ef75340afbecd7e9e53ac2
Size: 23.79 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
23.79 KB · 23,790 B
First seen
2026-07-13 17:16 · 3 months ago
Last seen
2026-07-13 17:16 · 3 months ago
Last analysis
2026-07-13 17:16 · 3 months ago
Hashes
MD5
661d2f5c01ef75340afbecd7e9e53ac2
Sha1
ecf20ebcb827572797898415ad7c53b392644514
Sha256
f514bdd056f1dc820943370241de7f3f0e492fd4cadeaf834f0c71400d6f6566
Sha384
40b97aff7b4a3d541dd1c3a54c67f7136cc27105ec250d817760cf7164962437945e07731ec5534e1e33b9904485886a
Sha512
9ca7cc81f7b2ff46f260cd3c6f8c52c7dc59b523afc9c51a1edb20f5dc434d52aa40a921888072c200c11ad6230066776006a957cfcbce043059351af68e22d2
SSDeep
384:VYsR+s3gurhcLU7EugepoLUlM9zWBG6vrkk+qfrMEd7VmZeE5UHbW9RaBe:VYsQOThH7+xMG5kFhVmZeE5wb0R
TLSH
D4B2C064E1616908E76B583ED22841F2B78D7609EC52E2DA3094F65EB6423F7139F8CC
34 malicious · 61 files
XLS661d2f5c01ef75340afbecd7e9e53ac2T1027 · T1059.001 · T1059.005
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
XMLworkbook.xml
BIN_rels
XMLworkbook.xml.rels
BINworksheets
XMLsheet1.xml
XMLsheet2.xml
XMLsheet3.xml
BIN_rels
XMLsheet2.xml.rels
XMLsheet3.xml.rels
BINtheme
XMLtheme1.xml
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
XMLdrawing1.xml
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSModule1
VBS[Stored VBA]T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
VBS[Stored VBA].deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PCode]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
BINprinterSettings
BINprinterSettings1.bin
XMLcalcChain.xml
BINdocProps
XMLcore.xml
XMLapp.xml
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 14
STICH kept: 9secondary ignored: 5
bin
1oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
9 / 9
Path
oox:xlsm>oox:vba~T1027~T1059.005>scr:ps1~T1027~T1059.001>scr:ps1~T1059.001>scr:ps1~T1059.001
Shape
oox:xlsm>oox:vba>scr:ps1>scr:ps1>scr:ps1
malicious
5 nodes
Path
oox:xlsm>oox:vba~T1027~T1059.005>scr:ps1~T1027~T1059.001>scr:ps1~T1027~T1059.001>scr:ps1~T1059.001
Shape
oox:xlsm>oox:vba>scr:ps1>scr:ps1>scr:ps1
malicious
5 nodes
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
hiddenhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
hiddenhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential34 malicious · 61 files
XLS661d2f5c01ef75340afbecd7e9e53ac2T1027 · T1059.001 · T1059.005
XML[Content_Types].xml
BIN_rels
BINxl
XMLworkbook.xml
BIN_rels
BINworksheets
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSModule1
VBS[Stored VBA]T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
VBS[Stored VBA].deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1059.001
PS1[PCode]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
BINprinterSettings
XMLcalcChain.xml
BINdocProps
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA]
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [Stored VBA].deobfuscated.vbs › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [Stored VBA].deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [Stored VBA].deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
hiddenhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [Stored VBA].deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
hiddenhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [Stored VBA].deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [Stored VBA].deobfuscated.vbs › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [Stored VBA].deobfuscated.vbs › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [Stored VBA].deobfuscated.vbs › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [Stored VBA].deobfuscated.vbs › [PowerShell Command] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [Stored VBA].deobfuscated.vbs › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [Stored VBA].deobfuscated.vbs › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
""
Inhuhuhuhuhuhuhuhuhuhuhu
661d2f5c01ef75340afbecd7e9e53ac2 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA] › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account