Deep Malware Analysis of 6ddcca3a162aa406d7681c4b81765b4e | md5: 6ddcca3a162aa406d7681c4b81765b4e | Office Document | VBA Stomping | ATT&CK T1564.007 | Malicious | Malicious Document | Blacklist VBA | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | SOS: 0.33 | SOS: 0.32 | SOS: 0.30 | SOS: 0.27 | COM Behavior Trace | SOS: 0.39 | SOS: 0.26 | SOS: 0.44 | SOS: 0.21

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	6ddcca3a162aa406d7681c4b81765b4e
Sha1	60cf4c1d8515f583b6300b77874821d45c123f2b
Sha256	74ffcff4d4618c1c3fe0c0750b391ea27383131e5340f98626afae76b69e5a6d
Sha384	737bdb1b56b552e655519632465131e55b95d59435195cee554c3a27b5fb7d5144be1c386a9301e5f1d20a5d0d7292d8
Sha512	e7e2ee968f7a90e8763077022b73bbf131bc648b12c7dcf1b354dd2ee6c6efab7c883290c2aa0425bc103d2b27f115a559f801da3a7e8896d08ca3d4d91e6012
SSDeep	6144:XxEtjPOtioVjZUGGnwfDlavx+W2QdAwPyzqtSaVZjEir+PmrokYbLobohHeebu6l:+yW0af4Q+/kFbosuaQ4JIjpaPl
TLSH	4ED46C2AB295C43BCF9906304C4E86E57A707C036F8EF78B764877AD3F7A7A09516640

Module1

Module3

Module5

Module8

Module11

Module12

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

8 / 8

Path ole:doc~T1027~T1059.005~T1564.007>bin

Shape ole:doc>bin

malicious 2 nodes

Path ole:doc~T1027~T1059.005~T1564.007>ole:vba~T1059.005

Shape ole:doc>ole:vba

malicious 2 nodes

Trace COM ordonnée UNKNWOWNmalicious

line 5huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 5huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 7huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

	Module Name0
	Module1	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Module2	VBA Macro
	Module3	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Module4	Blacklist VBA VBA Macro
	Module5	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module6	VBA Macro
	Module7	VBA Macro
	Module8	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module9	VBA Macro
	Module10	VBA Macro
	Module11	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module12	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	ThisWorkbook	VBA Macro