Deep Malware Analysis of 71759bf29eabe50d148cffc76af0df59 | md5: 71759bf29eabe50d148cffc76af0df59 | Office Document | Corrupted | VBA Stomping | ATT&CK T1564.007 | Malicious | Malicious Document | Blacklist VBA | DeObfuscated | VBScript | T1059.005 | Obfuscated | Excel.sheet | WScript.Shell | Shell.Application

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	71759bf29eabe50d148cffc76af0df59
Sha1	02841d2c882417b25079a6472831593ad9be854b
Sha256	aea199b36ee2217a7ad57c692e0b63bb6396dbe982c8b1a072881c4900356b54
Sha384	c48210e7bfa9469b47bca4c2beeba1ffc784052bb6aafc0322a77bc8d968de858ebf5def4edbc29f97a150a4bd496f6f
Sha512	cf7aa0e11f2c62a6b66ba5a9b12dac0706b7aa6430c8c7a6cc794cc35763d42a2fbaf00e0dd14cc867142782f1b9ee70f57ce887545d50aecb5296b39f542a54
SSDeep	24576:TJ9yggpgCkP3586TYyiMpVZmjFBFojyQtKIOIKlHpVQ6l7LIWIulQB5kilPXIRIY:T1pnVAQtvy
TLSH	0855D511F603C62BC699223148BAA3F53778AC491A864B57725CB33D3FF6B90DA47784

File Structure

Sheet6

CSHA256

Module1

Module2

Module3

Artefacts

Name	Value
URLs in VB Code - #1	http:/huhuhuhuhuhuhu
URLs in VB Code - #1	http:/huhuhuhuhuhuhu
URLs in VB Code - #1	http:/huhuhuhuhuhuhu
URLs in VB Code - #1	http:/huhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys…) are available with Essential.

Unlock with Essential

71759bf29eabe50d148cffc76af0df59 (1.3 MB)

	Module Name0
	Sheet6	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Sheet7	VBA Macro
	Sheet8	VBA Macro
	Sheet9	VBA Macro
	CSHA256	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module1	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module2	Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module3	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Sheet10	VBA Macro
	Sheet11	VBA Macro
	Sheet12	VBA Macro
	Sheet13	VBA Macro
	Sheet14	VBA Macro
	Sheet15	VBA Macro
	Sheet16	VBA Macro
	Sheet18	VBA Macro
	Sheet20	VBA Macro
	Sheet21	VBA Macro
	Sheet36	VBA Macro
	ThisWorkbook	VBA Macro