Deep Malware Analysis of 7b9e9b496d92d5999740f7c65e102497 | md5: 7b9e9b496d92d5999740f7c65e102497 | Office Document | Blacklist VBA | Scripting.FileSystemObject | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | COM Behavior Trace

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	7b9e9b496d92d5999740f7c65e102497
Sha1	06ee4b82c1dee0be659e5771a03f232be6de370c
Sha256	a3b44405112e6364447e5d96630edfabcf81e5ad37d690c3ebc73770d62aeabd
Sha384	acfc3bf9cd1675a3a1e52fe9bd0f346c06512901a3f30617e77ff45c29f746e4400144f231aec83d85523aa6e96d5f80
Sha512	e45ab4085af6436c9fb862271a1ce792ed64fcf0b22caccae2f7c6f631f0eb2f1a0c8803b9b9fbaad286f667546bdf35740e78db6430fdf70c53e76d349f5ae0
SSDeep	768:LhuUfNn7dWIs3EVCOR4p4NxllN2Tnv97sn/5eP692R:7f/WINVCOCMBYTv97I/kCc
TLSH	3213C078CB003808C563C63ED0EB65EBF6544D42E631999A7E49A3CE96F46C74F09EC9

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 4secondary ignored: 6

bin 1img 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path oox:docm>oox:vba~T1027~T1059.005

Shape oox:docm>oox:vba

malicious 2 nodes

Path oox:docm>ole:doc~T1059.005

Shape oox:docm>ole:doc

technique2 nodes

Dropped path (COM trace) #1 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #2 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #3 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #4 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #5 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #6 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #7 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential