Malicious
Malicious

758afea95b818063536b6fd7a5a15a92

VBScript
MD5: 758afea95b818063536b6fd7a5a15a92
Size: 771.58 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 758afea95b818063536b6fd7a5a15a92
Sha1 227e61eca20d832241a1e152920c42bf049f2e69
Sha256 cb60c05a179fc2f196486101d1c49be82cb4f6f1771212b02f21b97cfaa0331c
Sha384 61da16c4fcae99c3a5c48c892097ed15d385fa67d495f58714e1180de7c226faaf2d406b6ef7578ff78b4354dd70bcad
Sha512 a0a1eef62aae0047dd81ca9b7034530c9e198a7c3c5c32a7f9cf844a4b0c8bb976acd947652364bc3f2a81a55c19e5885582a2fc64f86eb21a8b3cf3bdf353b3
SSDeep 12288:K17aw2vxK1HBY3EfIfRLWOK6U0x9CFbrD2iKmYhKmiOg:/TAhgCIU0uFfD2iKo
TLSH 08F46C11FD56C838CA62653ADCC106F23A707C024E0AED8B3518733E7FB79775A6A616
758afea95b818063536b6fd7a5a15a92
Malicious
Root Entry
Malicious
CompObj
Workbook
SummaryInformation
DocumentSummaryInformation
_VBA_PROJECT_CUR
Malicious
PROJECT
PROJECTwm
VBA
Malicious
dir
Module1
Malicious
[Stored VBA]
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Full Diff]
Malicious
[Full Diff].deobfuscated.vbs
Malicious
[Partial Diff]
Malicious
Module1.deobfuscated.vbs
Malicious
Module2
Malicious

Module2

Malicious
[Stored VBA]
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Full Diff]
Malicious
[Partial Diff]
Malicious
Module3
Malicious

Module3

Malicious
[Stored VBA]
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Full Diff]
Malicious
[Partial Diff]
Malicious
__SRP_0
__SRP_1
__SRP_2
__SRP_3
__SRP_4
__SRP_5
__SRP_8
__SRP_9
__SRP_a
__SRP_b
ThisWorkbook

ThisWorkbook

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
_VBA_PROJECT
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
7 / 7
Path ole:doc~T1027~T1059.005~T1564.007>bin
Shape ole:doc>bin
malicious 2 nodes
Path ole:doc~T1027~T1059.005~T1564.007>ole:vba~T1059.005~T1564.007
Shape ole:doc>ole:vba
malicious 2 nodes
758afea95b818063536b6fd7a5a15a92
Malicious
Root Entry
Malicious
CompObj
Workbook
SummaryInformation
DocumentSummaryInformation
_VBA_PROJECT_CUR
Malicious
PROJECT
PROJECTwm
VBA
Malicious
dir
Module1
Malicious
[Stored VBA]
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Full Diff]
Malicious
[Full Diff].deobfuscated.vbs
Malicious
[Partial Diff]
Malicious
Module1.deobfuscated.vbs
Malicious
Module2
Malicious

Module2

Malicious
[Stored VBA]
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Full Diff]
Malicious
[Partial Diff]
Malicious
Module3
Malicious

Module3

Malicious
[Stored VBA]
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Full Diff]
Malicious
[Partial Diff]
Malicious
__SRP_0
__SRP_1
__SRP_2
__SRP_3
__SRP_4
__SRP_5
__SRP_8
__SRP_9
__SRP_a
__SRP_b
ThisWorkbook

ThisWorkbook

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
_VBA_PROJECT

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
Module2
VBA Stomping
ATT&CK T1564.007
Malicious
Malicious Document
Blacklist VBA
VBA Macro

Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis.

VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams.

To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective.

This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.

Module3
VBA Stomping
ATT&CK T1564.007
Malicious
Malicious Document
Blacklist VBA
VBA Macro

Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis.

VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams.

To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective.

This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.

ThisWorkbook
VBA Macro
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙