Deep Malware Analysis of 716885a4f1b47da5b175d7e4e562aa3c | md5: 716885a4f1b47da5b175d7e4e562aa3c | Office Document | Blacklist VBA | SOS: 0.38 | T1059.005 | SOS: 0.30 | Scripting.Dictionary | VBScript.RegExp | DeObfuscated | VBScript | Obfuscated | T1027 | COM Behavior Trace

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	716885a4f1b47da5b175d7e4e562aa3c
Sha1	ba09ab23e35ecf613cad1049b64acbd67d15782c
Sha256	c739a1ef6ce2777898a35c9013ed1f9919e3629f2286669059362cad1ce755d8
Sha384	bc5f3824e872c952bd3086c9319c40c768a4972d28b4a1cc32a514846b3b2e56c25480c7151e876e2739669a2bb3e310
Sha512	68d19ca2a653def42105d18a6a651d2868d3c35a4e8a3556f4c2683e49e42af6d0040eef40e0d26573312c8d2537b2edd8e38c26987bc6aa506c3676dc65253f
SSDeep	98304:h+Yao4vgZpVfPEfoa0rc5BXFc+q+ytzXy1wgT:naQZpV3Ei4Lc+wW1h
TLSH	38063319B2106AE9D4EB127C84AF168E833D982C421EE21D3647E4697EB1FCF460FD57

Module1

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 5secondary ignored: 5

bin 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

5 / 5

Path oox:xlsm>oox:vba~T1027~T1059.005

Shape oox:xlsm>oox:vba

malicious 2 nodes

Path oox:xlsm>ole:doc~T1059.005

Shape oox:xlsm>ole:doc

technique2 nodes

Trace COM ordonnée UNKNWOWNmalicious

line 4huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

	Module Name0
	Module1	Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.