897cb084996039a8732bcdf4f8043cda

MS Excel Document

MD5: 897cb084996039a8732bcdf4f8043cda

Size: 90.76 KB

application/vnd.ms-excel

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

90.76 KB · 90,755 B

First seen

2026-08-12 07:46 · 2 months ago

Last seen

2026-08-12 07:46 · 2 months ago

Last analysis

2026-08-12 07:46 · 2 months ago

Hashes

MD5 897cb084996039a8732bcdf4f8043cda Sha1 6f513ed7ad48084f1315975f2dfa4d4300da447c Sha256 b886360844748c3190ce13d70bf195060158f700d4d7c796252e511463dd8439 Sha384 e47890992aba2edb2efa395e87cbf91ae21a904091cc27d77630fddf001af096125a54956023dff26fa869302eed9c06 Sha512 2be69de4c5c11009b87ad3aeb7df9e8717268cac61effbc6e6c857a4960d11f732b68a0a5fa873d0fbb300f821d37c3fcbef36b1bb3ce30fd4f8a478e983881d SSDeep 1536:rPACXR5O0MjO/oRUzu08sn1QNOquYsBfVDcyY54J1vCom04:UK5OeoRUzZ8sn131xnY54J1vUN TLSH 2893F119D2B7F826C7AAB8F8D31C5BF1920E5902408235472D54B84C6B4337F6B9D7AE

4 malicious · 62 files

XLS897cb084996039a8732bcdf4f8043cda

XML[Content_Types].xml

BIN_rels

XML.rels

BINxl

XMLworkbook.xml

BIN_rels

XMLworkbook.xml.rels

BINworksheets

XMLsheet1.xml

XMLsheet2.xml

XMLsheet3.xml

XMLsheet4.xml

XMLsheet6.xml

XMLsheet5.xml

BIN_rels

XMLsheet1.xml.rels

XMLsheet2.xml.rels

XMLsheet5.xml.rels

XMLsheet6.xml.rels

BINtheme

XMLtheme1.xml

XMLstyles.xml

XMLsharedStrings.xml

OFFvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

VBAModule1

VBS[Stored VBA]

VBA[PCode]

VBAModule2

VBS[Stored VBA]

VBA[PCode]

VBAModule3

VBS[Stored VBA]

VBA[PCode]

VBAModule4

VBS[Stored VBA]

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

BIN__SRP_4

BIN__SRP_5

BIN_VBA_PROJECT

BINdrawings

XMLdrawing1.xml

VMLvmlDrawing1.vml

BINexternalLinks

XMLexternalLink1.xml

BIN_rels

OFFexternalLink1.xml.rels

BINprinterSettings

BINprinterSettings1.bin

BINprinterSettings2.bin

BINprinterSettings3.bin

BINctrlProps

XMLctrlProp1.xml

XMLcalcChain.xml

BINdocMetadata

XMLLabelInfo.xml

BINcustomXml

XMLitemProps1.xml

XMLitem2.xml

XMLitemProps2.xml

XMLitem3.xml

XMLitem1.xml

BIN_rels

XMLitem1.xml.rels

XMLitem2.xml.rels

XMLitem3.xml.rels

XMLitemProps3.xml

BINdocProps

XMLcore.xml

XMLapp.xml

XMLcustom.xml

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 9 STICH kept: 4secondary ignored: 5

bin 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path oox:xlsm>oox:rel:ext~T1221

Shape oox:xlsm>oox:rel:ext

technique2 nodes

Path oox:xlsm>oox:vba~T1059.005

Shape oox:xlsm>oox:vba

technique2 nodes

Config. Field	Value
Target	https:huhuhuhuhuhuhuhuhuhuhu
Path	externhuhuhuhuhuhuhu
XPath	/Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML	<Relathuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Remote Template - Highly Suspicious URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

4 malicious · 62 files

XLS897cb084996039a8732bcdf4f8043cda

XML[Content_Types].xml

BIN_rels

BINxl

XMLworkbook.xml

BIN_rels

BINworksheets

BINtheme

XMLstyles.xml

XMLsharedStrings.xml

OFFvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

VBAModule1

VBS[Stored VBA]

VBA[PCode]

VBAModule2

VBS[Stored VBA]

VBA[PCode]

VBAModule3

VBAModule4

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

BIN__SRP_4

BIN__SRP_5

BIN_VBA_PROJECT

BINdrawings

BINexternalLinks

XMLexternalLink1.xml

BIN_rels

OFFexternalLink1.xml.rels

BINprinterSettings

BINctrlProps

XMLcalcChain.xml

BINdocMetadata

BINcustomXml

BINdocProps

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	Module1	VBA Macro
	Module2	VBA Macro
	Module3	VBA Macro
	Module4	VBA Macro

Config. Field	Value
Target	https:huhuhuhuhuhuhuhuhuhuhu
Path	externhuhuhuhuhuhuhu
XPath	/Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML	<Relathuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Remote Template - Highly Suspicious URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

897cb084996039a8732bcdf4f8043cda › xl › externalLinks › _rels › externalLink1.xml.rels

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential