Deep Malware Analysis of 910c99f510f7f94bc8119ada9a173dde | md5: 910c99f510f7f94bc8119ada9a173dde | Office Document | VBA Stomping | ATT&CK T1564.007 | Malicious | Malicious Document | Blacklist VBA | T1059.005 | WScript.Shell | Shell.Application

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	910c99f510f7f94bc8119ada9a173dde
Sha1	c08e11b2c6f183a29a4f6b39d89c37d162ad429d
Sha256	9c2b300fd003ace63372fd99cb0676cd2448a3067877d420797bbbe49c9ca736
Sha384	9ff144813f0af2f39a1450c67d04c006a4a6826bcd3ab2b6bf988e354aa806277819561a4e9de14f3977c4a91d6548f1
Sha512	703bf066e223bfbb8dc165a69c2e3f778176d8057654bb5f45a1cb9dc4d52b9a178643f92838b3323580d2af4822b3a18702a9197faaf154b43aaf3d63a395b9
SSDeep	12288:WxgWhcMKBMiErnMa4r1jhw2whJ0Sy093yUhwPJDg8+jmGq:W76MUMiIMr1Rwv+TUhwPHbGq
TLSH	5CD4231DF765F44ECB1E003AE70D10E7162DBA95E091F64F3620BD885696AEB1B8E34C

CSHA256

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

12 / 12

Path oox:xlsm~T1059.005~T1564.007>oox:media>img

Shape oox:xlsm>oox:media>img

malicious 3 nodes

Path oox:xlsm~T1059.005~T1564.007>bin

Shape oox:xlsm>bin

malicious 2 nodes

	Module Name0
	Sheet7	VBA Macro
	CSHA256	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Sheet12	VBA Macro