Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
FileType
Microsoft Office Document
45 malicious · 282 files
XLSPortFormKit 1.18.xlsmMS Excel Document
XML[Content_Types].xmlextracted from MS Excel Document · XML
XMLworkbook.xmlextracted from MS Excel Document · XML
XMLstyles.xmlextracted from MS Excel Document · XML
XMLsharedStrings.xmlextracted from MS Excel Document · XML
OFFvbaProject.binextracted from MS Excel Document · MS Office Document
BINPROJECTextracted from MS Office Document
BINPROJECTwmextracted from MS Office Document
VBAGCsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBACMGsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBS[Decompiled VBA]decompiled · VBScript
BINdirextracted from MS Office Document
VBADPBsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAMainsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet5sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet7sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet8sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBALicensesub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet11sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet13sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet15sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet17sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBS[Decompiled VBA]decompiled · VBScript
VBASheet19sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet24sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet27sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet28sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBS[Decompiled VBA]decompiled · VBScript
BIN__SRP_0extracted from MS Office Document
BIN__SRP_1extracted from MS Office Document
BIN__SRP_2extracted from MS Office Document
BIN__SRP_3extracted from MS Office Document
BIN__SRP_4extracted from MS Office Document
BIN__SRP_5extracted from MS Office Document
BIN__SRP_6extracted from MS Office Document
BIN__SRP_7extracted from MS Office Document
BIN__SRP_8extracted from MS Office Document
BIN__SRP_9extracted from MS Office Document
BIN__SRP_aextracted from MS Office Document
BIN__SRP_bextracted from MS Office Document
BIN__SRP_cextracted from MS Office Document
BIN__SRP_dextracted from MS Office Document
BIN__SRP_eextracted from MS Office Document
BIN__SRP_fextracted from MS Office Document
VBAUIModulesub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
BIN__SRP_10extracted from MS Office Document
BIN__SRP_11extracted from MS Office Document
BIN__SRP_12extracted from MS Office Document
BIN__SRP_13extracted from MS Office Document
BIN__SRP_14extracted from MS Office Document
BIN__SRP_15extracted from MS Office Document
BIN__SRP_16extracted from MS Office Document
BIN__SRP_17extracted from MS Office Document
BIN__SRP_18extracted from MS Office Document
BIN__SRP_19extracted from MS Office Document
BIN__SRP_1aextracted from MS Office Document
BIN__SRP_1bextracted from MS Office Document
BIN__SRP_1cextracted from MS Office Document
BIN__SRP_1dextracted from MS Office Document
BIN__SRP_1eextracted from MS Office Document
BIN__SRP_1fextracted from MS Office Document
BIN__SRP_20extracted from MS Office Document
BIN__SRP_21extracted from MS Office Document
BIN__SRP_22extracted from MS Office Document
BIN__SRP_23extracted from MS Office Document
BIN__SRP_24extracted from MS Office Document
BIN__SRP_25extracted from MS Office Document
BIN__SRP_26extracted from MS Office Document
BIN__SRP_27extracted from MS Office Document
BIN__SRP_28extracted from MS Office Document
BIN__SRP_29extracted from MS Office Document
BIN__SRP_2aextracted from MS Office Document
BIN__SRP_2bextracted from MS Office Document
BIN__SRP_2cextracted from MS Office Document
BIN__SRP_2dextracted from MS Office Document
BIN__SRP_2eextracted from MS Office Document
BIN__SRP_2fextracted from MS Office Document
BIN__SRP_30extracted from MS Office Document
BIN__SRP_31extracted from MS Office Document
BIN__SRP_32extracted from MS Office Document
BIN__SRP_33extracted from MS Office Document
BIN__SRP_34extracted from MS Office Document
BIN__SRP_35extracted from MS Office Document
BIN__SRP_36extracted from MS Office Document
BIN__SRP_37extracted from MS Office Document
BIN__SRP_38extracted from MS Office Document
BIN__SRP_39extracted from MS Office Document
BIN__SRP_3aextracted from MS Office Document
BIN__SRP_3bextracted from MS Office Document
BIN__SRP_3cextracted from MS Office Document
BIN__SRP_3dextracted from MS Office Document
BIN__SRP_3eextracted from MS Office Document
BIN__SRP_3fextracted from MS Office Document
BIN__SRP_40extracted from MS Office Document
BIN__SRP_41extracted from MS Office Document
BIN__SRP_42extracted from MS Office Document
BIN__SRP_43extracted from MS Office Document
BIN__SRP_44extracted from MS Office Document
BIN__SRP_45extracted from MS Office Document
BIN__SRP_46extracted from MS Office Document
BIN__SRP_47extracted from MS Office Document
BIN__SRP_48extracted from MS Office Document
BIN__SRP_49extracted from MS Office Document
BIN__SRP_4aextracted from MS Office Document
BIN__SRP_4bextracted from MS Office Document
BIN__SRP_4cextracted from MS Office Document
BIN__SRP_4dextracted from MS Office Document
BIN__SRP_4eextracted from MS Office Document
BIN__SRP_4fextracted from MS Office Document
BIN__SRP_50extracted from MS Office Document
BIN__SRP_51extracted from MS Office Document
BIN__SRP_52extracted from MS Office Document
BIN__SRP_53extracted from MS Office Document
BIN__SRP_54extracted from MS Office Document
BIN__SRP_55extracted from MS Office Document
VBASelfChecksub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAProgressFormsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheetManagersub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAThisWorkbooksub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
BIN_VBA_PROJECTextracted from MS Office Document
VBALicenseManagersub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
XMLmetadata.xmlextracted from MS Excel Document · XML
XMLcalcChain.xmlextracted from MS Excel Document · XML
45 malicious · 282 files
XLSPortFormKit 1.18.xlsmMS Excel Document
XML[Content_Types].xmlextracted from MS Excel Document · XML
XMLworkbook.xmlextracted from MS Excel Document · XML
XMLstyles.xmlextracted from MS Excel Document · XML
XMLsharedStrings.xmlextracted from MS Excel Document · XML
OFFvbaProject.binextracted from MS Excel Document · MS Office Document
BINPROJECTextracted from MS Office Document
BINPROJECTwmextracted from MS Office Document
VBAGCsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBACMGsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBS[Decompiled VBA]decompiled · VBScript
BINdirextracted from MS Office Document
VBADPBsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAMainsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet5sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet7sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet8sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBALicensesub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet11sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet13sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet15sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet17sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBS[Decompiled VBA]decompiled · VBScript
VBASheet19sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet24sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet27sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet28sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBS[Decompiled VBA]decompiled · VBScript
BIN__SRP_0extracted from MS Office Document
BIN__SRP_1extracted from MS Office Document
BIN__SRP_2extracted from MS Office Document
BIN__SRP_3extracted from MS Office Document
BIN__SRP_4extracted from MS Office Document
BIN__SRP_5extracted from MS Office Document
BIN__SRP_6extracted from MS Office Document
BIN__SRP_7extracted from MS Office Document
BIN__SRP_8extracted from MS Office Document
BIN__SRP_9extracted from MS Office Document
BIN__SRP_aextracted from MS Office Document
BIN__SRP_bextracted from MS Office Document
BIN__SRP_cextracted from MS Office Document
BIN__SRP_dextracted from MS Office Document
BIN__SRP_eextracted from MS Office Document
BIN__SRP_fextracted from MS Office Document
VBAUIModulesub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
BIN__SRP_10extracted from MS Office Document
BIN__SRP_11extracted from MS Office Document
BIN__SRP_12extracted from MS Office Document
BIN__SRP_13extracted from MS Office Document
BIN__SRP_14extracted from MS Office Document
BIN__SRP_15extracted from MS Office Document
BIN__SRP_16extracted from MS Office Document
BIN__SRP_17extracted from MS Office Document
BIN__SRP_18extracted from MS Office Document
BIN__SRP_19extracted from MS Office Document
BIN__SRP_1aextracted from MS Office Document
BIN__SRP_1bextracted from MS Office Document
BIN__SRP_1cextracted from MS Office Document
BIN__SRP_1dextracted from MS Office Document
BIN__SRP_1eextracted from MS Office Document
BIN__SRP_1fextracted from MS Office Document
BIN__SRP_20extracted from MS Office Document
BIN__SRP_21extracted from MS Office Document
BIN__SRP_22extracted from MS Office Document
BIN__SRP_23extracted from MS Office Document
BIN__SRP_24extracted from MS Office Document
BIN__SRP_25extracted from MS Office Document
BIN__SRP_26extracted from MS Office Document
BIN__SRP_27extracted from MS Office Document
BIN__SRP_28extracted from MS Office Document
BIN__SRP_29extracted from MS Office Document
BIN__SRP_2aextracted from MS Office Document
BIN__SRP_2bextracted from MS Office Document
BIN__SRP_2cextracted from MS Office Document
BIN__SRP_2dextracted from MS Office Document
BIN__SRP_2eextracted from MS Office Document
BIN__SRP_2fextracted from MS Office Document
BIN__SRP_30extracted from MS Office Document
BIN__SRP_31extracted from MS Office Document
BIN__SRP_32extracted from MS Office Document
BIN__SRP_33extracted from MS Office Document
BIN__SRP_34extracted from MS Office Document
BIN__SRP_35extracted from MS Office Document
BIN__SRP_36extracted from MS Office Document
BIN__SRP_37extracted from MS Office Document
BIN__SRP_38extracted from MS Office Document
BIN__SRP_39extracted from MS Office Document
BIN__SRP_3aextracted from MS Office Document
BIN__SRP_3bextracted from MS Office Document
BIN__SRP_3cextracted from MS Office Document
BIN__SRP_3dextracted from MS Office Document
BIN__SRP_3eextracted from MS Office Document
BIN__SRP_3fextracted from MS Office Document
BIN__SRP_40extracted from MS Office Document
BIN__SRP_41extracted from MS Office Document
BIN__SRP_42extracted from MS Office Document
BIN__SRP_43extracted from MS Office Document
BIN__SRP_44extracted from MS Office Document
BIN__SRP_45extracted from MS Office Document
BIN__SRP_46extracted from MS Office Document
BIN__SRP_47extracted from MS Office Document
BIN__SRP_48extracted from MS Office Document
BIN__SRP_49extracted from MS Office Document
BIN__SRP_4aextracted from MS Office Document
BIN__SRP_4bextracted from MS Office Document
BIN__SRP_4cextracted from MS Office Document
BIN__SRP_4dextracted from MS Office Document
BIN__SRP_4eextracted from MS Office Document
BIN__SRP_4fextracted from MS Office Document
BIN__SRP_50extracted from MS Office Document
BIN__SRP_51extracted from MS Office Document
BIN__SRP_52extracted from MS Office Document
BIN__SRP_53extracted from MS Office Document
BIN__SRP_54extracted from MS Office Document
BIN__SRP_55extracted from MS Office Document
VBASelfChecksub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAProgressFormsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheetManagersub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAThisWorkbooksub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
BIN_VBA_PROJECTextracted from MS Office Document
VBALicenseManagersub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
XMLmetadata.xmlextracted from MS Excel Document · XML
XMLcalcChain.xmlextracted from MS Excel Document · XML
vbaDNA - VBA Stomping & Purging Stategy detection
|
|
Module Name0 |
|
|---|
|
GC |
|
|
CMG |
|
|
DPB |
|
|
Main |
|
|
Sheet5 |
|
|
Sheet7 |
|
|
Sheet8 |
|
|
License |
|
|
Sheet11 |
|
|
Sheet13 |
|
|
Sheet15 |
|
|
Sheet17 |
|
|
Sheet19 |
|
|
Sheet24 |
|
|
Sheet27 |
|
|
Sheet28 |
|
|
UIModule |
|
|
SelfCheck |
|
|
ProgressForm |
|
|
SheetManager |
|
|
ThisWorkbook |
|
|
LicenseManager |
|
No malware configuration was found at this point.
Coming soon: export of this report's indicators to MISP and EDR platforms.
