Deep Malware Analysis of 661d2f5c01ef75340afbecd7e9e53ac2 | md5: 661d2f5c01ef75340afbecd7e9e53ac2 | Office Document | Blacklist VBA | T1059.005 | PowerShell | T1059.001 | T1027 | DeObfuscated | Scripting.FileSystemObject | WScript.Shell | VBScript | Obfuscated

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	661d2f5c01ef75340afbecd7e9e53ac2
Sha1	ecf20ebcb827572797898415ad7c53b392644514
Sha256	f514bdd056f1dc820943370241de7f3f0e492fd4cadeaf834f0c71400d6f6566
Sha384	40b97aff7b4a3d541dd1c3a54c67f7136cc27105ec250d817760cf7164962437945e07731ec5534e1e33b9904485886a
Sha512	9ca7cc81f7b2ff46f260cd3c6f8c52c7dc59b523afc9c51a1edb20f5dc434d52aa40a921888072c200c11ad6230066776006a957cfcbce043059351af68e22d2
SSDeep	384:VYsR+s3gurhcLU7EugepoLUlM9zWBG6vrkk+qfrMEd7VmZeE5UHbW9RaBe:VYsQOThH7+xMG5kFhVmZeE5wb0R
TLSH	D4B2C064E1616908E76B583ED22841F2B78D7609EC52E2DA3094F65EB6423F7139F8CC

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 14 STICH kept: 9secondary ignored: 5

bin 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

9 / 9

Path oox:xlsm>oox:vba~T1027~T1059.005>scr:ps1~T1027~T1059.001>scr:ps1~T1059.001>scr:ps1~T1059.001

Shape oox:xlsm>oox:vba>scr:ps1>scr:ps1>scr:ps1

malicious 5 nodes

Path oox:xlsm>oox:vba~T1027~T1059.005>scr:ps1~T1027~T1059.001>scr:ps1~T1027~T1059.001>scr:ps1~T1059.001

Shape oox:xlsm>oox:vba>scr:ps1>scr:ps1>scr:ps1

malicious 5 nodes

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu