90350a1a4ce42690e49d4e3fec7d67c3

MS Excel Document

MD5: 90350a1a4ce42690e49d4e3fec7d67c3

Size: 1.87 MB

application/vnd.ms-excel

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

1.87 MB · 1,871,357 B

First seen

2026-09-07 17:45 · one month ago

Last seen

2026-09-07 17:45 · one month ago

Last analysis

2026-09-07 17:46 · one month ago

Hashes

MD5 90350a1a4ce42690e49d4e3fec7d67c3 Sha1 23e7c45fc03416caa7934f556b57ab2fae1320e6 Sha256 4b21147281f95a5358d6bbca5a8fdbea681268f4b11e43ef7a446b862d3d0bd9 Sha384 112c9632fc26291f24ec7d353ce79023b21ff63b4897287438ffb371b0c1f0b55eec8d71d2960eaab9868db55782d846 Sha512 0d2bcc694605674139acf7d4d7b8bc79e047384267fd29420877245c0842c215f64d76acd5467a5f4e87a36c70b21704392f897b28f5f1dba6345133e3aec208 SSDeep 49152:Lbnly000JTfi8qXxkEBAvKOfIqZE4sHXK90tMVhWA7Q9f:nNipiOzOfIyE9HXRtMVMeQt TLSH E185D0A7E4C8369CFE0EDAB74E106F84A1F5ABF018919C3F4A5C7090590299F336959F

48 malicious · 224 files

XLS90350a1a4ce42690e49d4e3fec7d67c3

IMG0x000F9B04.svg

IMG0x000F9B04.svg-preview.jpg

IMG0x000FA840.svg

IMG0x000FA840.svg-preview.jpg

IMG0x000FC429.svg

IMG0x000FC429.svg-preview.jpg

IMG0x000FD213.svg

IMG0x000FD213.svg-preview.jpg

IMG0x000FE4E4.svg

IMG0x000FE4E4.svg-preview.jpg

IMG0x000FF361.svg

IMG0x000FF361.svg-preview.jpg

IMG0x001002E6.svg

IMG0x001002E6.svg-preview.jpg

IMG0x001011A5.svg

IMG0x001011A5.svg-preview.jpg

IMG0x00103070.svg

IMG0x00103070.svg-preview.jpg

IMG0x00104285.svg

IMG0x00104285.svg-preview.jpg

IMG0x00106242.svg

IMG0x00106242.svg-preview.jpg

IMG0x00107D24.svg

IMG0x00107D24.svg-preview.jpg

XML[Content_Types].xml

BIN_rels

XML.rels

BINxl

XMLworkbook.xml

BIN_rels

XMLworkbook.xml.rels

BINworksheets

XMLsheet1.xml

XMLsheet2.xml

XMLsheet3.xml

XMLsheet4.xml

XMLsheet5.xml

XMLsheet6.xml

XMLsheet7.xml

XMLsheet8.xml

XMLsheet9.xml

XMLsheet10.xml

XMLsheet11.xml

XMLsheet12.xml

XMLsheet13.xml

XMLsheet14.xml

XMLsheet15.xml

XMLsheet16.xml

XMLsheet17.xml

XMLsheet18.xml

BIN_rels

XMLsheet1.xml.rels

XMLsheet2.xml.rels

XMLsheet3.xml.rels

XMLsheet5.xml.rels

XMLsheet6.xml.rels

XMLsheet7.xml.rels

XMLsheet8.xml.rels

XMLsheet9.xml.rels

XMLsheet10.xml.rels

XMLsheet11.xml.rels

XMLsheet12.xml.rels

XMLsheet13.xml.rels

XMLsheet14.xml.rels

XMLsheet15.xml.rels

XMLsheet16.xml.rels

XMLsheet17.xml.rels

XMLsheet4.xml.rels

BINtheme

XMLtheme1.xml

XMLstyles.xml

XMLsharedStrings.xml

BINdrawings

XMLdrawing1.xml

XMLdrawing2.xml

XMLdrawing3.xml

XMLdrawing4.xml

VMLvmlDrawing1.vml

BIN_rels

XMLdrawing1.xml.rels

OFFdrawing2.xml.rels

OFFdrawing3.xml.rels

XMLvmlDrawing1.vml.rels

OFFdrawing10.xml.rels

OFFdrawing15.xml.rels

XMLvmlDrawing4.vml.rels

XMLvmlDrawing5.vml.rels

XMLdrawing5.xml

VMLvmlDrawing2.vml

XMLdrawing6.xml

XMLdrawing7.xml

XMLdrawing8.xml

XMLdrawing9.xml

VMLvmlDrawing3.vml

XMLdrawing10.xml

XMLdrawing11.xml

XMLdrawing12.xml

XMLdrawing13.xml

XMLdrawing14.xml

XMLdrawing15.xml

VMLvmlDrawing4.vml

XMLdrawing16.xml

VMLvmlDrawing5.vml

BINmedia

IMGimage1.png

IMGimage1.png-preview.png

IMGimage2.png

IMGimage2.png-preview.png

IMGimage3.png

IMGimage3.png-preview.png

IMGimage4.png

IMGimage4.png-preview.png

IMGimage6.png

IMGimage6.png-preview.png

IMGimage8.png

IMGimage8.png-preview.png

IMGimage10.png

IMGimage10.png-preview.png

IMGimage12.png

IMGimage12.png-preview.png

IMGimage14.png

IMGimage14.png-preview.png

IMGimage16.png

IMGimage16.png-preview.png

IMGimage18.png

IMGimage18.png-preview.png

IMGimage20.png

IMGimage20.png-preview.png

IMGimage22.png

IMGimage22.png-preview.png

IMGimage24.png

IMGimage24.png-preview.png

IMGimage26.png

IMGimage26.png-preview.png

EMFimage28.emf

EMFimage29.emf

EMFimage30.emf

EMFimage31.emf

EMFimage32.emf

EMFimage33.emf

EMFimage34.emf

EMFimage35.emf

EMFimage36.emf

EMFimage37.emf

EMFimage38.emf

EMFimage39.emf

EMFimage40.emf

EMFimage41.emf

EMFimage42.emf

EMFimage43.emf

EMFimage44.emf

EMFimage45.emf

EMFimage46.emf

EMFimage47.emf

EMFimage48.emf

EMFimage49.emf

EMFimage50.emf

EMFimage51.emf

EMFimage52.emf

EMFimage53.emf

EMFimage54.emf

BINwebextensions

XMLtaskpanes.xml

XMLwebextension1.xml

BIN_rels

XMLtaskpanes.xml.rels

BINcharts

XMLchart1.xml

OFFvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTlk

BINPROJECTwm

BINVBA

BINdir

VBSRAB

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBSAHSP

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBSAHSP.deobfuscated.vbs

VBAANTEK

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBASheet1

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBASheet2

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBSSheet3

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBSSheet3.deobfuscated.vbs

VBSSheet4

PS1[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

PS1[PCode]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

VBASheet5

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBSSheet6

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBSSheet7

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

15 / 15

Path ole:doc~T1027~T1059.005~T1105>oox:vba~T1059.005>scr:ps1~T1027~T1059.001~T1105

Shape ole:doc>oox:vba>scr:ps1

malicious 3 nodes

Path ole:doc~T1027~T1059.005~T1105>oox:vba~T1027~T1059.005~T1105

Shape ole:doc>oox:vba

malicious 2 nodes

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu
URL (COM trace) #2	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #1 URImalicious

http:/huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #2 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #3 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 2huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 5huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 7huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 2huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

file:/huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

file:/huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

48 malicious · 224 files

XLS90350a1a4ce42690e49d4e3fec7d67c3

IMG0x000F9B04.svg

IMG0x000FA840.svg

IMG0x000FC429.svg

IMG0x000FD213.svg

IMG0x000FE4E4.svg

IMG0x000FF361.svg

IMG0x001002E6.svg

IMG0x001011A5.svg

IMG0x00103070.svg

IMG0x00104285.svg

IMG0x00106242.svg

IMG0x00107D24.svg

XML[Content_Types].xml

BIN_rels

BINxl

XMLworkbook.xml

BIN_rels

BINworksheets

BINtheme

XMLstyles.xml

XMLsharedStrings.xml

BINdrawings

BINmedia

BINwebextensions

BINcharts

OFFvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTlk

BINPROJECTwm

BINVBA

BINdir

VBSRAB

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBSAHSP

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBSAHSP.deobfuscated.vbs

VBAANTEK

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBASheet1

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBASheet2

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBSSheet3

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBSSheet3.deobfuscated.vbs

VBSSheet4

PS1[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

PS1[PCode]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

VBASheet5

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBSSheet6

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBSSheet7

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	ANTEK	Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Sheet1	VBA Macro
	Sheet2	VBA Macro
	Sheet5	Blacklist VBA VBA Macro

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu
URL (COM trace) #2	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › vbaProject.bin › Root Entry › VBA › Sheet4 › [Decompiled VBA]

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › vbaProject.bin › Root Entry › VBA › Sheet4 › [Decompiled VBA]

URL in PowerShell #1 URImalicious

http:/huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › vbaProject.bin › Root Entry › VBA › Sheet4 › [PCode] › [PowerShell Command]

URL in PowerShell #2 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › vbaProject.bin › Root Entry › VBA › Sheet4 › [PCode] › [PowerShell Command]

URL in PowerShell #3 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › vbaProject.bin › Root Entry › VBA › Sheet4 › [PCode] › [PowerShell Command]

Trace COM ordonnée UNKNWOWNmalicious

line 2huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › vbaProject.bin › Root Entry › VBA › Sheet3 › [Decompiled VBA]

Trace COM ordonnée UNKNWOWNmalicious

line 5huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › vbaProject.bin › Root Entry › VBA › Sheet4 › [Stored VBA]

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › vbaProject.bin › Root Entry › VBA › Sheet3 › [Stored VBA]

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › vbaProject.bin › Root Entry › VBA › Sheet3

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › vbaProject.bin › Root Entry › VBA › Sheet3

Trace COM ordonnée UNKNWOWNmalicious

line 7huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › vbaProject.bin › Root Entry › VBA › AHSP › [Decompiled VBA]

Trace COM ordonnée UNKNWOWNmalicious

line 2huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › vbaProject.bin › Root Entry › VBA › ANTEK › [Decompiled VBA]

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › vbaProject.bin › Root Entry › VBA › RAB › [Stored VBA]

Remote Resource Reference URIsuspect

file:/huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › drawings › _rels › drawing3.xml.rels

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › drawings › _rels › drawing15.xml.rels

Remote Resource Reference URIsuspect

file:/huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › drawings › _rels › drawing2.xml.rels

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › drawings › _rels › drawing15.xml.rels

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › drawings › _rels › drawing15.xml.rels

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › drawings › _rels › drawing15.xml.rels

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › drawings › _rels › drawing15.xml.rels

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › drawings › _rels › drawing15.xml.rels

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › drawings › _rels › drawing15.xml.rels

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › drawings › _rels › drawing15.xml.rels

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

90350a1a4ce42690e49d4e3fec7d67c3 › xl › drawings › _rels › drawing15.xml.rels

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential