Malicious
MS Excel Document
MD5: 897cb084996039a8732bcdf4f8043cda
Size: 90.76 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
90.76 KB · 90,755 B
First seen
2026-08-12 07:46 · 2 months ago
Last seen
2026-08-12 07:46 · 2 months ago
Last analysis
2026-08-12 07:46 · 2 months ago
Hashes
MD5
897cb084996039a8732bcdf4f8043cda
Sha1
6f513ed7ad48084f1315975f2dfa4d4300da447c
Sha256
b886360844748c3190ce13d70bf195060158f700d4d7c796252e511463dd8439
Sha384
e47890992aba2edb2efa395e87cbf91ae21a904091cc27d77630fddf001af096125a54956023dff26fa869302eed9c06
Sha512
2be69de4c5c11009b87ad3aeb7df9e8717268cac61effbc6e6c857a4960d11f732b68a0a5fa873d0fbb300f821d37c3fcbef36b1bb3ce30fd4f8a478e983881d
SSDeep
1536:rPACXR5O0MjO/oRUzu08sn1QNOquYsBfVDcyY54J1vCom04:UK5OeoRUzZ8sn131xnY54J1vUN
TLSH
2893F119D2B7F826C7AAB8F8D31C5BF1920E5902408235472D54B84C6B4337F6B9D7AE
4 malicious · 62 files
XLS897cb084996039a8732bcdf4f8043cdaT1221 · T1059.005
XML[Content_Types].xml
BIN_rels
BINxl
XMLworkbook.xml
BIN_rels
BINworksheets
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
OFFvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAModule1
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModule2
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModule3
VBAModule4
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN_VBA_PROJECT
BINdrawings
BINexternalLinks
XMLexternalLink1.xml
BIN_rels
OFFexternalLink1.xml.relsT1221
BINprinterSettings
BINctrlProps
XMLcalcChain.xml
BINdocMetadata
BINcustomXml
BINdocProps
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 9
STICH kept: 4secondary ignored: 5
bin
1oox:metadata
1oox:style
1oox:theme
1xml
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
4 / 4
Path
oox:xlsm>oox:rel:ext~T1221
Shape
oox:xlsm>oox:rel:ext
technique2 nodes
Path
oox:xlsm>oox:vba~T1059.005
Shape
oox:xlsm>oox:vba
technique2 nodes
| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | externhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential