Malicious MS Excel Document analysis – c2e920944d99

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

606.81 KB · 606,810 B

First seen

2025-06-27 09:00 · one year ago

Last seen

2025-06-27 09:00 · one year ago

Last analysis

2025-06-27 09:02 · one year ago

Hashes

MD5 810a4dd4c0c9d0949698d1d7f0c7f925 Sha1 cb9593a0e00c59e92423d3b863d62e3b572ec72d Sha256 c2e920944d994ba28bc9e159491a89d83e305e63fafc4a4e25433db63800d5fa Sha384 30cb8b783fe13c0655e5c7448f0fb84589579b76480e80c62656a517f9c2407d7e3d6855ee81e02414b6cf570ca3b69a Sha512 12bb0caeb707959f27723befb7a13188aab5508760782fce26652f20342de3b0860b91063c85defaf205ff1d0b88f8a54a33cb8d5fe6a21e8919ac6faa12b63e SSDeep 12288:G7n7vTGbw6NbMHSeFXFx2Zae2vMV5pPq5a7saQ+1gOygsQeNlGZ+WVUlWA:+7vaZijFXFx2jcMV3CaQ+15VElGgCUlf TLSH 25D4238A4573D289CC40D43D96DC0F391DEC02ED0DF836EE4651CA9ABB64FDDA5EA806

7 malicious · 27 files

XLS810a4dd4c0c9d0949698d1d7f0c7f925

XML[Content_Types].xml

BIN_rels

BINxl

XMLworkbook.xml

BIN_rels

BINworksheets

BINtheme

XMLstyles.xml

XMLsharedStrings.xml

OFFvbaProject.bin

BIN.

BINRoot Entry

BINVBA

BINdir

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

VBAThisWorkbook

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

BIN_VBA_PROJECT

BINPROJECT

BINPROJECTwm

BINdocProps

	Module Name0
	ThisWorkbook	Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.