Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
FileType
Microsoft Office Document
65 malicious · 288 files
XLSPortFormKit 1.19.xlsmMS Excel Document
XML[Content_Types].xmlextracted from MS Excel Document · XML
XMLworkbook.xmlextracted from MS Excel Document · XML
XMLstyles.xmlextracted from MS Excel Document · XML
XMLsharedStrings.xmlextracted from MS Excel Document · XML
OFFvbaProject.binextracted from MS Excel Document · MS Office Document
BINPROJECTextracted from MS Office Document
BINPROJECTwmextracted from MS Office Document
VBAGCsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBACMGsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBS[Decompiled VBA]decompiled · VBScript
BINdirextracted from MS Office Document
VBADPBsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAMainsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet5sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet7sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet8sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet9sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBALicensesub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet10sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet11sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet13sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet14sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet15sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet16sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet17sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet19sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet20sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBS[Decompiled VBA]decompiled · VBScript
VBASheet22sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet24sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet25sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet26sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet27sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet28sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAShheet2sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAShheet3sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
BIN__SRP_0extracted from MS Office Document
BIN__SRP_1extracted from MS Office Document
BIN__SRP_2extracted from MS Office Document
BIN__SRP_3extracted from MS Office Document
BIN__SRP_4extracted from MS Office Document
BIN__SRP_5extracted from MS Office Document
BIN__SRP_6extracted from MS Office Document
BIN__SRP_7extracted from MS Office Document
BIN__SRP_8extracted from MS Office Document
BIN__SRP_9extracted from MS Office Document
BIN__SRP_aextracted from MS Office Document
BIN__SRP_bextracted from MS Office Document
BIN__SRP_cextracted from MS Office Document
BIN__SRP_dextracted from MS Office Document
BIN__SRP_eextracted from MS Office Document
BIN__SRP_fextracted from MS Office Document
VBAUIModulesub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
BIN__SRP_10extracted from MS Office Document
BIN__SRP_11extracted from MS Office Document
BIN__SRP_12extracted from MS Office Document
BIN__SRP_13extracted from MS Office Document
BIN__SRP_14extracted from MS Office Document
BIN__SRP_15extracted from MS Office Document
BIN__SRP_16extracted from MS Office Document
BIN__SRP_17extracted from MS Office Document
BIN__SRP_18extracted from MS Office Document
BIN__SRP_19extracted from MS Office Document
BIN__SRP_1aextracted from MS Office Document
BIN__SRP_1bextracted from MS Office Document
BIN__SRP_1cextracted from MS Office Document
BIN__SRP_1dextracted from MS Office Document
BIN__SRP_1eextracted from MS Office Document
BIN__SRP_1fextracted from MS Office Document
BIN__SRP_20extracted from MS Office Document
BIN__SRP_21extracted from MS Office Document
BIN__SRP_22extracted from MS Office Document
BIN__SRP_23extracted from MS Office Document
BIN__SRP_24extracted from MS Office Document
BIN__SRP_25extracted from MS Office Document
BIN__SRP_26extracted from MS Office Document
BIN__SRP_27extracted from MS Office Document
BIN__SRP_28extracted from MS Office Document
BIN__SRP_29extracted from MS Office Document
BIN__SRP_2aextracted from MS Office Document
BIN__SRP_2bextracted from MS Office Document
BIN__SRP_2cextracted from MS Office Document
BIN__SRP_2dextracted from MS Office Document
BIN__SRP_2eextracted from MS Office Document
BIN__SRP_2fextracted from MS Office Document
BIN__SRP_30extracted from MS Office Document
BIN__SRP_31extracted from MS Office Document
VBASelfChecksub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAProgressFormsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheetManagersub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAThisWorkbooksub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
BIN_VBA_PROJECTextracted from MS Office Document
VBALicenseManagersub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
XMLmetadata.xmlextracted from MS Excel Document · XML
XMLcalcChain.xmlextracted from MS Excel Document · XML
65 malicious · 288 files
XLSPortFormKit 1.19.xlsmMS Excel Document
XML[Content_Types].xmlextracted from MS Excel Document · XML
XMLworkbook.xmlextracted from MS Excel Document · XML
XMLstyles.xmlextracted from MS Excel Document · XML
XMLsharedStrings.xmlextracted from MS Excel Document · XML
OFFvbaProject.binextracted from MS Excel Document · MS Office Document
BINPROJECTextracted from MS Office Document
BINPROJECTwmextracted from MS Office Document
VBAGCsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBACMGsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBS[Decompiled VBA]decompiled · VBScript
BINdirextracted from MS Office Document
VBADPBsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAMainsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet5sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet7sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet8sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet9sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBALicensesub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet10sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet11sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet13sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet14sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet15sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet16sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet17sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet19sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet20sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBS[Decompiled VBA]decompiled · VBScript
VBASheet22sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet24sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet25sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet26sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet27sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheet28sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAShheet2sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAShheet3sub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
BIN__SRP_0extracted from MS Office Document
BIN__SRP_1extracted from MS Office Document
BIN__SRP_2extracted from MS Office Document
BIN__SRP_3extracted from MS Office Document
BIN__SRP_4extracted from MS Office Document
BIN__SRP_5extracted from MS Office Document
BIN__SRP_6extracted from MS Office Document
BIN__SRP_7extracted from MS Office Document
BIN__SRP_8extracted from MS Office Document
BIN__SRP_9extracted from MS Office Document
BIN__SRP_aextracted from MS Office Document
BIN__SRP_bextracted from MS Office Document
BIN__SRP_cextracted from MS Office Document
BIN__SRP_dextracted from MS Office Document
BIN__SRP_eextracted from MS Office Document
BIN__SRP_fextracted from MS Office Document
VBAUIModulesub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
BIN__SRP_10extracted from MS Office Document
BIN__SRP_11extracted from MS Office Document
BIN__SRP_12extracted from MS Office Document
BIN__SRP_13extracted from MS Office Document
BIN__SRP_14extracted from MS Office Document
BIN__SRP_15extracted from MS Office Document
BIN__SRP_16extracted from MS Office Document
BIN__SRP_17extracted from MS Office Document
BIN__SRP_18extracted from MS Office Document
BIN__SRP_19extracted from MS Office Document
BIN__SRP_1aextracted from MS Office Document
BIN__SRP_1bextracted from MS Office Document
BIN__SRP_1cextracted from MS Office Document
BIN__SRP_1dextracted from MS Office Document
BIN__SRP_1eextracted from MS Office Document
BIN__SRP_1fextracted from MS Office Document
BIN__SRP_20extracted from MS Office Document
BIN__SRP_21extracted from MS Office Document
BIN__SRP_22extracted from MS Office Document
BIN__SRP_23extracted from MS Office Document
BIN__SRP_24extracted from MS Office Document
BIN__SRP_25extracted from MS Office Document
BIN__SRP_26extracted from MS Office Document
BIN__SRP_27extracted from MS Office Document
BIN__SRP_28extracted from MS Office Document
BIN__SRP_29extracted from MS Office Document
BIN__SRP_2aextracted from MS Office Document
BIN__SRP_2bextracted from MS Office Document
BIN__SRP_2cextracted from MS Office Document
BIN__SRP_2dextracted from MS Office Document
BIN__SRP_2eextracted from MS Office Document
BIN__SRP_2fextracted from MS Office Document
BIN__SRP_30extracted from MS Office Document
BIN__SRP_31extracted from MS Office Document
VBASelfChecksub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAProgressFormsub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBASheetManagersub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
VBAThisWorkbooksub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
BIN_VBA_PROJECTextracted from MS Office Document
VBALicenseManagersub-stream · VBA Module
VBS[Stored VBA]code extracted · VBScript
VBA[PCode]disassembled · VBA Module
VBS[Decompiled VBA]decompiled · VBScript
XMLmetadata.xmlextracted from MS Excel Document · XML
XMLcalcChain.xmlextracted from MS Excel Document · XML
vbaDNA - VBA Stomping & Purging Stategy detection
|
|
Module Name0 |
|
|---|
|
GC |
|
|
CMG |
|
|
DPB |
|
|
Main |
|
|
Sheet5 |
|
|
Sheet7 |
|
|
Sheet8 |
|
|
Sheet9 |
|
|
License |
|
|
Sheet10 |
|
|
Sheet11 |
|
|
Sheet13 |
|
|
Sheet14 |
|
|
Sheet15 |
|
|
Sheet16 |
|
|
Sheet17 |
|
|
Sheet19 |
|
|
Sheet20 |
|
|
Sheet22 |
|
|
Sheet24 |
|
|
Sheet25 |
|
|
Sheet26 |
|
|
Sheet27 |
|
|
Sheet28 |
|
|
Shheet2 |
|
|
Shheet3 |
|
|
UIModule |
|
|
SelfCheck |
|
|
ProgressForm |
|
|
SheetManager |
|
|
ThisWorkbook |
|
|
LicenseManager |
|
No malware configuration was found at this point.
Coming soon: export of this report's indicators to MISP and EDR platforms.
