Malicious
MS Office Document
MD5: a43bcb6aefde2133474a3a3cc069f2f7
Size: 1.3 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
1.3 MB · 1,300,992 B
First seen
2025-08-01 15:30 · one year ago
Last seen
2025-08-01 15:30 · one year ago
Last analysis
2025-08-01 15:36 · one year ago
Hashes
MD5
a43bcb6aefde2133474a3a3cc069f2f7
Sha1
3e7822f1045a025010cf50110f90d54924f40a25
Sha256
751f9fabe3997ba63e604599dc50b6a1ec3f7ed4a0d86ae3dff6d562a6277a23
Sha384
944cb019fe2b67ee9a16f9b03c55d6d79d42573511491ea4c9dffa8c1e414f4a742c0f8d84608cacdf612c939f60cef4
Sha512
762482873baf40a65404129c22dfdce04e4f300ac9b1d315d48efc3ab3b3a974ec1b0100a80c5c48f27d586d419d64a9539844252d0b4e579a4c2d338b4d88e3
SSDeep
24576:LJ9yggpgCkqY586TYyiMptZmjFBFojyQtKIOIKlHpVQ6l7LIWIulQB5kilPXIRI8:LoWntAQtve
TLSH
A955D511F603C62BC699223148BAA3F53778AC491A864B57725CB33D3FF6B90DA47784
68 malicious · 166 files
OFFa43bcb6aefde2133474a3a3cc069f2f7T1059.005 · ATT&CK T1564.007
OFF[Repaired @0x0001AA65]
BINRoot Entry
BINCompObj
OFFWorkbook
OFF[Repaired @0x0001A865]
BINSummaryInformation
BINDocumentSummaryInformation
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBASheet6ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBASheet7
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet8
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBASheet9
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBACSHA256ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAModule1ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAModule2
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAModule3ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBASheet10
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet11
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet12
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet13
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet14
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet15
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet16
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet18
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet20
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet21
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBASheet36
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
VBAThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN_VBA_PROJECT
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential68 malicious · 166 files
OFFa43bcb6aefde2133474a3a3cc069f2f7T1059.005 · ATT&CK T1564.007
OFF[Repaired @0x0001AA65]
BINRoot Entry
BINCompObj
OFFWorkbook
OFF[Repaired @0x0001A865]
BINSummaryInformation
BINDocumentSummaryInformation
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBASheet6ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBASheet7
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet8
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBASheet9
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBACSHA256ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAModule1ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAModule2
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAModule3ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBASheet10
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet11
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet12
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet13
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet14
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet15
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet16
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet18
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet20
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet21
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBASheet36
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
VBAThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN_VBA_PROJECT
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhu
a43bcb6aefde2133474a3a3cc069f2f7
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account