Malicious MS Excel Document analysis – a3f73e1b9ef7

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

99 malicious · 290 files

XLSa3f73e1b9ef746b59643603fb711e93a

XML[Content_Types].xml

BIN_rels

BINxl

XMLworkbook.xml

BIN_rels

BINworksheets

BINtheme

XMLstyles.xml

XMLsharedStrings.xml

BINdrawings

BINmedia

OFFvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

VBASheet1

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAbneMain

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

BIN__SRP_6

BIN__SRP_7

BIN__SRP_c

BIN__SRP_d

BIN__SRP_e

BIN__SRP_f

VBABNEERROR

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBA[Full Diff]

VBA[Partial Diff]

VBABneStyle

BIN__SRP_10

BIN__SRP_11

BIN__SRP_12

BIN__SRP_13

BIN__SRP_14

BIN__SRP_15

BIN__SRP_16

BIN__SRP_17

BIN__SRP_18

BIN__SRP_19

BIN__SRP_1a

BIN__SRP_1b

BIN__SRP_1c

BIN__SRP_1d

BIN__SRP_1e

BIN__SRP_1f

BIN__SRP_20

BIN__SRP_21

BIN__SRP_22

BIN__SRP_23

BIN__SRP_24

BIN__SRP_25

BIN__SRP_26

BIN__SRP_27

BIN__SRP_28

BIN__SRP_29

BIN__SRP_2a

BIN__SRP_2b

BIN__SRP_2c

BIN__SRP_2d

BIN__SRP_2e

BIN__SRP_2f

BIN__SRP_30

BIN__SRP_31

BIN__SRP_32

BIN__SRP_33

BIN__SRP_34

BIN__SRP_35

BIN__SRP_36

BIN__SRP_37

BIN__SRP_38

BIN__SRP_39

VBABneLayout

VBABneRibbon

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

VBABneBrowser

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

VBABneSaxPath

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBA[Partial Diff]

VBAbneMsgLogger

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBAThisWorkbook

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

BIN_VBA_PROJECT

VBABneStyleSheet

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBABneVBAMessage

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBA[Partial Diff]

VBABneXSDElement

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBABneDownloadXSD

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

VBABneLayoutBlock

VBAbneRibbonUtils

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBABneRowInserter

VBABneUploadBlock

VBABneUploadSheet

VBABneVBAMessages

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBABneVBAProperty

VBABneVBAUploader

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBABneLayoutColumn

VBABneSummarySheet

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBABneUploadColumn

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBABneUploadLayout

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

VBABneVBAParameter

VBABneImageProperty

VBAbneReadOnlyUtils

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBABneStyleProperty

VBABneVBAParameters

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBABneVBAProperties

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBABneUploadColumnRow

VBABneVBAInterfaceCol

VBABneSaxDownloadErrorHandler

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBA[Full Diff]

VBA[Partial Diff]

VBABneSAXDownloadContentHandler

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBS[Full Diff]

VBA[Partial Diff]

BINBneBrowser

BINdocProps

BINcustomUI

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #4 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #5 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #6 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #7 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #8 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #9 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #10 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #11 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

	Module Name0
	Sheet1	Blacklist VBA VBA Macro
	bneMain	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	BNEERROR	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	BneStyle	Blacklist VBA VBA Macro
	BneLayout	VBA Macro
	BneRibbon	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	BneBrowser	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	BneSaxPath	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bneMsgLogger	VBA Macro
	ThisWorkbook	VBA Macro
	BneStyleSheet	VBA Macro
	BneVBAMessage	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	BneXSDElement	VBA Macro
	BneDownloadXSD	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	BneLayoutBlock	Blacklist VBA VBA Macro
	bneRibbonUtils	Blacklist VBA VBA Macro
	BneRowInserter	VBA Macro
	BneUploadBlock	VBA Macro
	BneUploadSheet	VBA Macro
	BneVBAMessages	VBA Macro
	BneVBAProperty	VBA Macro
	BneVBAUploader	Blacklist VBA VBA Macro
	BneLayoutColumn	VBA Macro
	BneSummarySheet	Blacklist VBA VBA Macro
	BneUploadColumn	VBA Macro
	BneUploadLayout	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	BneVBAParameter	VBA Macro
	BneImageProperty	VBA Macro
	bneReadOnlyUtils	VBA Macro
	BneStyleProperty	VBA Macro
	BneVBAParameters	VBA Macro
	BneVBAProperties	VBA Macro
	BneUploadColumnRow	VBA Macro
	BneVBAInterfaceCol	VBA Macro
	BneSaxDownloadErrorHandler	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	BneSAXDownloadContentHandler	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential