Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 b37271aa7483aa0134902fe624a44e05
Sha1 79375a12fd8752f666f46c648e6103b99ab936ee
Sha256 fb4a58906435de0d537fcaf7aa5e8258697258b81bf59eb00ed77f08418b0176
Sha384 c6f489650c2c1adbb748eac2dec1c865037d674f7439962bf7fb1b0c870f15575671e3dc8b5785dc9a6608ab28afcb20
Sha512 60ac8f13b23d64a9ebb6ad971b6a3e92353824cd30e73474db077b734f99536c2b03a4caf7fa14cb781597af3cec405b36f66ca8f7f7cfe42a4c45f915cfe049
SSDeep 12288:WQrA68UsWmMEgDyilxclFeAmHT4Gf0dhPgcZxU4nY:HB6R7eAqT4Gf0nPgc7U4Y
TLSH 3CC4221DA27AE868C33AD038D22C11D5E08E68A19055E70E3750FE4C52B72DB5BCEF6D
b37271aa7483aa0134902fe624a44e05
Malicious
[Content_Types].xml
_rels
.rels
xl
Malicious
_rels
workbook.xml.rels
workbook.xml
worksheets
sheet4.xml
_rels
sheet8.xml.rels
sheet7.xml.rels
sheet6.xml.rels
sheet5.xml.rels
sheet9.xml.rels
sheet10.xml.rels
sheet11.xml.rels
sheet12.xml.rels
sheet13.xml.rels
sheet14.xml.rels
sheet3.xml.rels
sheet1.xml.rels
sheet15.xml.rels
sheet16.xml.rels
sheet17.xml.rels
sheet18.xml.rels
sheet19.xml.rels
sheet20.xml.rels
sheet21.xml.rels
sheet22.xml.rels
sheet2.xml
sheet3.xml
sheet1.xml
sheet20.xml
sheet17.xml
sheet16.xml
sheet15.xml
sheet18.xml
sheet21.xml
sheet22.xml
sheet23.xml
sheet24.xml
sheet19.xml
sheet8.xml
sheet7.xml
sheet6.xml
sheet5.xml
sheet9.xml
sheet14.xml
sheet13.xml
sheet12.xml
sheet11.xml
sheet10.xml
drawings
drawing12.xml
drawing13.xml
drawing14.xml
drawing15.xml
drawing16.xml
drawing17.xml
_rels
drawing8.xml.rels
drawing15.xml.rels
drawing16.xml.rels
drawing17.xml.rels
drawing1.xml.rels
drawing3.xml.rels
vmlDrawing1.vml
drawing11.xml
drawing2.xml
drawing3.xml
drawing1.xml
drawing4.xml
drawing8.xml
drawing9.xml
drawing10.xml
drawing7.xml
drawing6.xml
drawing5.xml
media
image7.png
image7.png-preview.png
image2.png
image2.png-preview.png
image3.png
image3.png-preview.png
image1.png
image1.png-preview.png
image5.png
image5.png-preview.png
image6.png
image6.png-preview.png
image4.png
image4.png-preview.png
vbaProject.bin
Malicious
Root Entry
Malicious
PROJECT
PROJECTwm
VBA
Malicious
dir
Sheet6
Malicious
[Stored VBA]
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Full Diff]
Malicious
[Partial Diff]
Malicious
Sheet7

Sheet7

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet8
Malicious
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet9
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
CSHA256
Malicious

CSHA256

Malicious
[Stored VBA]
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Full Diff]
Malicious
[Partial Diff]
Malicious
Module1
Malicious
[Stored VBA]
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Full Diff]
Malicious
[Partial Diff]
Malicious
Module2
Malicious
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Module3
Malicious
[Stored VBA]
Malicious
[PCode]
Malicious
[Decompiled VBA]
Malicious
[Full Diff]
Malicious
[Partial Diff]
Malicious
Sheet10
Malicious
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet11
Malicious
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet12

Sheet12

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet13
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet14
Malicious
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet15
Malicious
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet16
Malicious
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet18
Malicious
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet20
Malicious
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet21
Malicious
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
Sheet36
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
__SRP_0
__SRP_1
__SRP_2
__SRP_3
__SRP_4
__SRP_5
__SRP_6
__SRP_7
__SRP_8
__SRP_9
__SRP_a
__SRP_b
__SRP_c
__SRP_d
__SRP_e
__SRP_f
__SRP_10
__SRP_11
__SRP_12
__SRP_13
__SRP_14
__SRP_15
__SRP_16
__SRP_17
__SRP_18
__SRP_19
__SRP_1a
__SRP_1b
__SRP_1c
__SRP_1d
__SRP_1e
__SRP_1f
__SRP_20
__SRP_21
__SRP_22
__SRP_23
__SRP_24
__SRP_25
__SRP_26
__SRP_27
__SRP_28
__SRP_29
__SRP_2a
__SRP_2b
__SRP_2c
__SRP_2d
__SRP_2e
__SRP_2f
__SRP_30
__SRP_31
__SRP_32
__SRP_33
__SRP_34
__SRP_35
__SRP_36
__SRP_37
ThisWorkbook
Malicious
[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
_VBA_PROJECT
theme
theme1.xml
styles.xml
sharedStrings.xml
printerSettings
printerSettings8.bin
printerSettings3.bin
printerSettings2.bin
printerSettings10.bin
printerSettings9.bin
printerSettings7.bin
printerSettings6.bin
printerSettings4.bin
printerSettings1.bin
ctrlProps
ctrlProp3.xml
calcChain.xml
docProps
app.xml
core.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
15 / 15
Path oox:xlsm~T1027~T1059.005~T1564.007>oox:media>img
Shape oox:xlsm>oox:media>img
malicious 3 nodes
Path oox:xlsm~T1027~T1059.005~T1564.007>bin
Shape oox:xlsm>bin
malicious 2 nodes
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 4huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 4huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 4huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙