Deep Malware Analysis of 6ee31f08d0ebac20f7925122c52bf0e8 | md5: 6ee31f08d0ebac20f7925122c52bf0e8 | Office Document | Blacklist VBA | Scripting.FileSystemObject | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | COM Behavior Trace

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	6ee31f08d0ebac20f7925122c52bf0e8
Sha1	9209093ce7d9aa84a1debaf8eab0f3e3b8a1f3d0
Sha256	e068794cf43e381b26c82d746cca107b9f84327a2a8308d5b87ea5529963c4c8
Sha384	b63ba746a10a2c9a0ea231c463605bf48ac8d18655afee8f2fc93aa287a5c4036b0bb4fba4e8ecb399d3b1b020627454
Sha512	9970c15092944ee265b101ea84ee037108f763441d5d24cd6d3781e6e29f5b5af5c54ec3e0ddfe0af393329d7ad5cdebc9503946dd2fcdac786b16ede82fd658
SSDeep	768:Lh2kzV6NbhRlISR4ERnMKw7U4p4NxllNlShWv9GZ/5eP69+N9:oS6NJISWERnM37xMB/ShG9a/kCwn
TLSH	8313C13ADF006414C267C63C94F95F96F9280682E311A6C63644E3EEDFE15C75E05E9E

Module1

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 4secondary ignored: 6

bin 1img 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path oox:docm>oox:vba~T1027~T1059.005

Shape oox:docm>oox:vba

malicious 2 nodes

Path oox:docm>ole:doc~T1059.005

Shape oox:docm>ole:doc

technique2 nodes

Dropped path (COM trace) #1 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #2 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #3 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #4 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #5 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #6 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #7 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

	Module Name0
	Module1	Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.