Deep Malware Analysis of 758afea95b818063536b6fd7a5a15a92 | md5: 758afea95b818063536b6fd7a5a15a92 | Office Document | VBA Stomping | ATT&CK T1564.007 | Malicious | Malicious Document | Blacklist VBA | T1059.005 | DeObfuscated | VBScript | Obfuscated | T1027

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	758afea95b818063536b6fd7a5a15a92
Sha1	227e61eca20d832241a1e152920c42bf049f2e69
Sha256	cb60c05a179fc2f196486101d1c49be82cb4f6f1771212b02f21b97cfaa0331c
Sha384	61da16c4fcae99c3a5c48c892097ed15d385fa67d495f58714e1180de7c226faaf2d406b6ef7578ff78b4354dd70bcad
Sha512	a0a1eef62aae0047dd81ca9b7034530c9e198a7c3c5c32a7f9cf844a4b0c8bb976acd947652364bc3f2a81a55c19e5885582a2fc64f86eb21a8b3cf3bdf353b3
SSDeep	12288:K17aw2vxK1HBY3EfIfRLWOK6U0x9CFbrD2iKmYhKmiOg:/TAhgCIU0uFfD2iKo
TLSH	08F46C11FD56C838CA62653ADCC106F23A707C024E0AED8B3518733E7FB79775A6A616

Module2

Module3

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

7 / 7

Path ole:doc~T1027~T1059.005~T1564.007>bin

Shape ole:doc>bin

malicious 2 nodes

Path ole:doc~T1027~T1059.005~T1564.007>ole:vba~T1059.005~T1564.007

Shape ole:doc>ole:vba

malicious 2 nodes

	Module Name0
	Module2	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Module3	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	ThisWorkbook	VBA Macro