Malicious
a0d9be2cf57f3829bdd9c0016f3ad3e4
MS Excel Document
MD5: a0d9be2cf57f3829bdd9c0016f3ad3e4
Size: 781.31 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
781.31 KB · 781,313 B
First seen
2026-09-07 17:45 · one month ago
Last seen
2026-09-07 17:45 · one month ago
Last analysis
2026-09-07 17:46 · one month ago
Hashes
MD5
a0d9be2cf57f3829bdd9c0016f3ad3e4
Sha1
f71fb57960fa70dabccaaefd6923534eeb43661d
Sha256
51b317d9ab8da4fb78cce6508cd7d8348bacac87db2e0ec07b0b0bc9834d73b4
Sha384
d1230142a61a9e654a8fff853ac1506d78de00563d2c249685f2749d938d64d104a0b1bb74cca9fbe13958d2c2bf0f39
Sha512
0ab7bb547b7061d5cf6f60cf8132588875be678a6dff020c0471f46bc61e9553a9687e6bcaa6a5d2909731ab6b5d72ec6474f000b81ca45067d505c2b781bc35
SSDeep
12288:FLZHqjKOhTPQbjEFTOC03z5X/ESFfJ36SvjVxWX0Erd7edhcYx1BdZ:FLZcKqPujaTIDZESK8jEZ7mqYd
TLSH
68F423A6CA5D6978C76D7038D1680CE36D0CBA656152FD9D3290F89C0B2B4F70B4FA6C
93 malicious · 290 files
XLSa0d9be2cf57f3829bdd9c0016f3ad3e4T1027 · T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
XMLworkbook.xml
BIN_rels
XMLworkbook.xml.rels
BINworksheets
XMLsheet1.xml
XMLsheet2.xml
XMLsheet3.xml
XMLsheet4.xml
XMLsheet5.xml
XMLsheet6.xml
XMLsheet7.xml
XMLsheet8.xml
XMLsheet9.xml
XMLsheet10.xml
XMLsheet11.xml
XMLsheet12.xml
XMLsheet13.xml
XMLsheet14.xml
XMLsheet15.xml
XMLsheet16.xml
XMLsheet17.xml
XMLsheet18.xml
XMLsheet19.xml
XMLsheet20.xml
XMLsheet21.xml
XMLsheet22.xml
BIN_rels
XMLsheet12.xml.rels
XMLsheet1.xml.rels
XMLsheet3.xml.rels
XMLsheet5.xml.rels
XMLsheet6.xml.rels
XMLsheet7.xml.rels
XMLsheet8.xml.rels
XMLsheet9.xml.rels
XMLsheet10.xml.rels
XMLsheet11.xml.rels
XMLsheet13.xml.rels
XMLsheet14.xml.rels
XMLsheet15.xml.rels
XMLsheet16.xml.rels
XMLsheet17.xml.rels
XMLsheet18.xml.rels
XMLsheet19.xml.rels
XMLsheet20.xml.rels
XMLsheet21.xml.rels
BINtheme
XMLtheme1.xml
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
XMLdrawing1.xml
BIN_rels
XMLdrawing12.xml.rels
XMLdrawing13.xml.rels
XMLdrawing14.xml.rels
XMLdrawing16.xml.rels
XMLdrawing1.xml.rels
XMLdrawing3.xml.rels
XMLdrawing7.xml.rels
XMLdrawing2.xml
XMLdrawing3.xml
XMLdrawing4.xml
XMLdrawing5.xml
XMLdrawing6.xml
XMLdrawing7.xml
XMLdrawing8.xml
XMLdrawing9.xml
XMLdrawing10.xml
XMLdrawing11.xml
XMLdrawing12.xml
XMLdrawing13.xml
XMLdrawing14.xml
XMLdrawing15.xml
XMLdrawing16.xml
BINmedia
IMGimage1.png
IMGimage1.png-preview.png
IMGimage2.png
IMGimage2.png-preview.png
IMGimage3.png
IMGimage3.png-preview.png
IMGimage4.png
IMGimage4.png-preview.png
IMGimage5.png
IMGimage5.png-preview.png
IMGimage6.png
IMGimage6.png-preview.png
IMGimage7.png
IMGimage7.png-preview.png
OFFvbaProject.binATT&CK T1564.007
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSSheet5T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet7ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBASheet8
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet9T1059.005 · ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBACSHA256ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSModule1ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSModule2T1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSModule2.deobfuscated.vbsT1059.005
VBSModule3ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBSSheet10T1059.005 · ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSSheet13
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet14T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet15T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet16
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet17T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet18ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSSheet19T1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet19.deobfuscated.vbsT1059.005
VBSSheet21T1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet21.deobfuscated.vbsT1059.005
VBSSheet22T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
VBAThisWorkbook
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS_VBA_PROJECT
BINprinterSettings
BINprinterSettings1.bin
BINprinterSettings3.bin
BINprinterSettings4.bin
BINprinterSettings9.bin
BINprinterSettings8.bin
BINprinterSettings10.bin
BINprinterSettings13.bin
XMLcalcChain.xml
BINdocProps
XMLcore.xml
XMLapp.xml
XMLcustom.xml
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
15 / 15
Path
oox:xlsm~T1027~T1059.005~T1564.007>oox:media>img
Shape
oox:xlsm>oox:media>img
malicious
3 nodes
Path
oox:xlsm~T1027~T1059.005~T1564.007>bin
Shape
oox:xlsm>bin
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 9huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential93 malicious · 290 files
XLSa0d9be2cf57f3829bdd9c0016f3ad3e4T1027 · T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
BINxl
XMLworkbook.xml
BIN_rels
BINworksheets
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
BINmedia
OFFvbaProject.binATT&CK T1564.007
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBSSheet5T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet7ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBASheet8
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet9T1059.005 · ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBACSHA256ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSModule1ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSModule2T1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSModule2.deobfuscated.vbsT1059.005
VBSModule3ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBSSheet10T1059.005 · ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSSheet13
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet14T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet15T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet16
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet17T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet18ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSSheet19T1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet19.deobfuscated.vbsT1059.005
VBSSheet21T1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSheet21.deobfuscated.vbsT1059.005
VBSSheet22T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
VBAThisWorkbook
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS_VBA_PROJECT
BINprinterSettings
XMLcalcChain.xml
BINdocProps
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet5 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet5 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet7 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet8 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet8 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet7 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 9huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet7 › [Full Diff]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet9 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet9 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet9 › [Full Diff]
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Full Diff]
Trace COM ordonnée
UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Module1 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Module2 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet10 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet10 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet10 › [Full Diff]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet13 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet14 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet13 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet14 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet15 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet15 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet16 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet16 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet17 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet17 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet18 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet18 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet18 › [Full Diff]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet19 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet21 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet19 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet21 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet22 › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › Sheet22 › [Decompiled VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › ThisWorkbook › [Stored VBA]
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
a0d9be2cf57f3829bdd9c0016f3ad3e4 › xl › vbaProject.bin › Root Entry › VBA › ThisWorkbook › [Decompiled VBA]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account