Malicious
Malicious

810a4dd4c0c9d0949698d1d7f0c7f925

MS Excel Document
MD5: 810a4dd4c0c9d0949698d1d7f0c7f925
Size: 606.81 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
Size
606.81 KB · 606,810 B
First seen
2025-06-27 09:00 · one year ago
Last seen
2025-06-27 09:00 · one year ago
Last analysis
2025-06-27 09:02 · one year ago
Hashes
MD5 810a4dd4c0c9d0949698d1d7f0c7f925 Sha1 cb9593a0e00c59e92423d3b863d62e3b572ec72d Sha256 c2e920944d994ba28bc9e159491a89d83e305e63fafc4a4e25433db63800d5fa Sha384 30cb8b783fe13c0655e5c7448f0fb84589579b76480e80c62656a517f9c2407d7e3d6855ee81e02414b6cf570ca3b69a Sha512 12bb0caeb707959f27723befb7a13188aab5508760782fce26652f20342de3b0860b91063c85defaf205ff1d0b88f8a54a33cb8d5fe6a21e8919ac6faa12b63e SSDeep 12288:G7n7vTGbw6NbMHSeFXFx2Zae2vMV5pPq5a7saQ+1gOygsQeNlGZ+WVUlWA:+7vaZijFXFx2jcMV3CaQ+15VElGgCUlf TLSH 25D4238A4573D289CC40D43D96DC0F391DEC02ED0DF836EE4651CA9ABB64FDDA5EA806
7 malicious · 27 files
XLS810a4dd4c0c9d0949698d1d7f0c7f925
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
XMLworkbook.xml
BIN_rels
XMLworkbook.xml.rels
BINworksheets
XMLsheet1.xml
BINtheme
XMLtheme1.xml
XMLstyles.xml
XMLsharedStrings.xml
BIN[Base64-Block @0x0000072E]
OFFvbaProject.bin
BIN.
BINRoot Entry
BINVBA
BINdir
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
VBAThisWorkbook
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
BIN_VBA_PROJECT
BINPROJECT
BINPROJECTwm
BINdocProps
XMLcore.xml
XMLapp.xml
7 malicious · 27 files
XLS810a4dd4c0c9d0949698d1d7f0c7f925
XML[Content_Types].xml
BINxl
XMLworkbook.xml
XMLstyles.xml
OFFvbaProject.bin
BIN.
BINRoot Entry
BINVBA
BINdir
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
VBAThisWorkbook
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
BIN_VBA_PROJECT
BINPROJECT
BINPROJECTwm

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
ThisWorkbook
Blacklist VBA
VBA Macro

Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis.

VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams.

To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective.

This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙