Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Microsoft Office Document
64 malicious · 318 files
XLSa78f018814b6024e31be8f343afcb322
XML[Content_Types].xml
BINxl
XMLworkbook.xml
XMLstyles.xml
XMLsharedStrings.xml
OFFvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBASheet2
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet3
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet5
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet7
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBACSHA256
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBS[Full Diff]
VBA[Partial Diff]
VBAModule1
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet10
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBS[Decompiled VBA]
VBS[Decompiled VBA].deobfuscated.vbs
VBASheet12
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet16
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet17
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet23
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBASheet24
VBS[Stored VBA]
VBS[Decompiled VBA]
VBASheet25
VBS[Stored VBA]
VBS[Decompiled VBA]
VBASheet26
VBS[Stored VBA]
VBS[Decompiled VBA]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAFileUtil
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
BIN__SRP_2c
BIN__SRP_2d
BIN__SRP_2e
BIN__SRP_2f
BIN__SRP_30
BIN__SRP_31
BIN__SRP_32
BIN__SRP_33
BIN__SRP_34
BIN__SRP_35
BIN__SRP_36
BIN__SRP_37
BIN__SRP_38
BIN__SRP_39
BIN__SRP_3a
BIN__SRP_3b
BIN__SRP_3c
BIN__SRP_3d
BIN__SRP_3e
BIN__SRP_3f
BIN__SRP_40
BIN__SRP_41
BIN__SRP_42
BIN__SRP_43
BIN__SRP_44
BIN__SRP_45
BIN__SRP_46
BIN__SRP_47
BIN__SRP_48
BIN__SRP_49
BIN__SRP_4a
BIN__SRP_4b
BIN__SRP_4c
BIN__SRP_4d
BIN__SRP_4e
BIN__SRP_4f
BIN__SRP_50
BIN__SRP_51
BIN__SRP_52
BIN__SRP_53
BIN__SRP_54
BIN__SRP_55
VBAPDF_Module
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBS[Decompiled VBA]
VBAValidateMod
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAHashing_JSON
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBS[Decompiled VBA]
VBAThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN_VBA_PROJECT
VBACommon_Module
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAJsonConverter
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBS[Decompiled VBA]
VBASigning_Module
VBS[Stored VBA]
VBS[Stored VBA].deobfuscated.vbs
VBA[PCode]
VBS[Decompiled VBA]
VBAImport_Error_JSON
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAImport_JSON_Module
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAValidate_Functions
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAVariable_Initialize
VBS[Stored VBA]
VBA[PCode]
BINexternalLinks
XMLexternalLink1.xml
XMLexternalLink2.xml
XMLexternalLink3.xml
XMLexternalLink4.xml
XMLexternalLink5.xml
BIN_rels
OFFexternalLink4.xml.rels
OFFexternalLink5.xml.rels
OFFexternalLink1.xml.rels
OFFexternalLink2.xml.rels
OFFexternalLink3.xml.rels
XMLcalcChain.xml
Config. Field Value
Target file:/huhuhuhuhuhuhuhuhuhuhu
Path externhuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Target https:huhuhuhuhuhuhuhuhuhuhu
Path externhuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Target file:/huhuhuhuhuhuhuhuhuhuhu
Path externhuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Target https:huhuhuhuhuhuhuhuhuhuhu
Path externhuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Target https:huhuhuhuhuhuhuhuhuhuhu
Path externhuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Target https:huhuhuhuhuhuhuhuhuhuhu
Path externhuhuhuhuhuhuhu
XPath /Relathuhuhuhuhuhuhuhuhuhuhu
Outer XML <Relathuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #9 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #10 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #12 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #13 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #14 URIsuspect
hthuhuhuhu
Remote Template - Highly Suspicious URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious URImalicious
file:/huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Remote Template - Highly Suspicious URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙