b572151155cdb30aa3c5096071720dbf

MS Excel Document
|
MD5: b572151155cdb30aa3c5096071720dbf
|
Size: 592.07 KB
|
application/vnd.ms-excel

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	b572151155cdb30aa3c5096071720dbf
Sha1	cb22695d92994cd2cdee3aadd8304262f18495ea
Sha256	8ef4f92eeff604c0dbd125cf358350141d9e3c1ef400775365b202c5d95b920e
Sha384	afb825e42566ab845cd628b969954064c140cf28f92a8762f967194894e4b46d45015541f21046d4534d01f299fd0b14
Sha512	9d6488562f96130ebe62524aec176db3a040e1e2027816592caece8f561070ae3613d80fa3361767fa10c30c63f76c522c2f6f9a2ad34cfd81a4f1a06d4c9042
SSDeep	12288:zu/ue0pjbVj+nKDiEQeDhmgpWwXU6uAh0Uso0jqKC:+u/pSnBngpWD6uLUJ0jRC
TLSH	25C41219C627721ED91FD039F3A447E26446B72AD083E1AE6D50B84C33272E767CE64D

File Structure

CSHA256

Signing_Module

Malware Configuration - Remote Template

Config. Field0	Value
Target	file:///C:\Users\ashutosh.khaitan\Desktop\Worksheet%20in%20SRS_Offline_GSTR10_30052018.xls
Path	externalLink2.xml.rels
XPath	/Relationships/Relationship
Outer XML	<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/externalLinkPath" Target="file:///C:\Users\ashutosh.khaitan\Desktop\Worksheet%20in%20SRS_Offline_GSTR10_30052018.xls" TargetMode="External" xmlns="http://schemas.openxmlformats.org/package/2006/relationships" />

Malware Configuration - Remote Template

Config. Field0	Value
Target	file:///C:\Users\pallav_yadav\Documents\GSTR_4_Offline_Utility_v3.0_new_PY.xls
Path	externalLink3.xml.rels
XPath	/Relationships/Relationship
Outer XML	<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/externalLinkPath" Target="file:///C:\Users\pallav_yadav\Documents\GSTR_4_Offline_Utility_v3.0_new_PY.xls" TargetMode="External" xmlns="http://schemas.openxmlformats.org/package/2006/relationships" />

Malware Configuration - Remote Template

Config. Field0	Value
Target	file:///C:\Users\richi.jain\AppData\Local\Temp\Temp1_GSTR_4_Offline_Utility.zip\GSTR_4_Offline_Utility_v3.0.xls
Path	externalLink1.xml.rels
XPath	/Relationships/Relationship
Outer XML	<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/externalLinkPath" Target="file:///C:\Users\richi.jain\AppData\Local\Temp\Temp1_GSTR_4_Offline_Utility.zip\GSTR_4_Offline_Utility_v3.0.xls" TargetMode="External" xmlns="http://schemas.openxmlformats.org/package/2006/relationships" />

Artefacts

Name0	Value
URLs in VB Code - #1	https://github.com/VBA-tools/VBA-JSON
URLs in VB Code - #2	http://www.opensource.org/licenses/mit-license.php
URLs in VB Code - #3	http://code.google.com/p/vba-json/
URLs in VB Code - #4	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724421.aspx
URLs in VB Code - #5	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724949.aspx
URLs in VB Code - #6	http://msdn.microsoft.com/en-us/library/windows/desktop/ms725485.aspx
URLs in VB Code - #7	http://support.microsoft.com/kb/269370
URLs in VB Code - #8	http://www.ietf.org/rfc/rfc4627.txt
URLs in VB Code - #9	https://support.microsoft.com/en-us/kb/272138
URLs in VB Code - #10	http://www.vbaccelerator.com/home/VB/Code/Techniques/RunTime_Debug_Tracing/VB6_Tracer_Utility_zip_cStringBuilder_cls.asp
URLs in VB Code - #11	https://github.com/VBA-tools/VBA-JSON/pull/82
URLs in VB Code - #12	https://github.com/VBA-tools/VBA-UtcConverter
URLs in VB Code - #13	http://s
URLs in VB Code - #14	http://www.frez.co.uk
URLs in VB Code - #1	http://www.frez.co.uk
URLs in VB Code - #1	http://www.frez.co.uk
URLs in VB Code - #1	https://github.com/VBA-tools/VBA-JSON
URLs in VB Code - #2	http://www.opensource.org/licenses/mit-license.php
URLs in VB Code - #3	http://code.google.com/p/vba-json/
URLs in VB Code - #4	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724421.aspx
URLs in VB Code - #5	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724949.aspx
URLs in VB Code - #6	http://msdn.microsoft.com/en-us/library/windows/desktop/ms725485.aspx
URLs in VB Code - #7	http://support.microsoft.com/kb/269370
URLs in VB Code - #8	http://www.ietf.org/rfc/rfc4627.txt
URLs in VB Code - #9	https://support.microsoft.com/en-us/kb/272138
URLs in VB Code - #10	http://www.vbaccelerator.com/home/VB/Code/Techniques/RunTime_Debug_Tracing/VB6_Tracer_Utility_zip_cStringBuilder_cls.asp
URLs in VB Code - #11	https://github.com/VBA-tools/VBA-JSON/pull/82
URLs in VB Code - #12	https://github.com/VBA-tools/VBA-UtcConverter
URLs in VB Code - #13	http://s
URLs in VB Code - #1	https://github.com/VBA-tools/VBA-JSON
URLs in VB Code - #2	http://www.opensource.org/licenses/mit-license.php
URLs in VB Code - #3	http://code.google.com/p/vba-json/
URLs in VB Code - #4	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724421.aspx
URLs in VB Code - #5	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724949.aspx
URLs in VB Code - #6	http://msdn.microsoft.com/en-us/library/windows/desktop/ms725485.aspx
URLs in VB Code - #7	http://support.microsoft.com/kb/269370
URLs in VB Code - #8	http://www.ietf.org/rfc/rfc4627.txt
URLs in VB Code - #9	https://support.microsoft.com/en-us/kb/272138
URLs in VB Code - #10	http://www.vbaccelerator.com/home/VB/Code/Techniques/RunTime_Debug_Tracing/VB6_Tracer_Utility_zip_cStringBuilder_cls.asp
URLs in VB Code - #11	https://github.com/VBA-tools/VBA-JSON/pull/82
URLs in VB Code - #12	https://github.com/VBA-tools/VBA-UtcConverter
URLs in VB Code - #1	https://github.com/VBA-tools/VBA-JSON
URLs in VB Code - #2	http://www.opensource.org/licenses/mit-license.php
URLs in VB Code - #3	http://code.google.com/p/vba-json/
URLs in VB Code - #4	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724421.aspx
URLs in VB Code - #5	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724949.aspx
URLs in VB Code - #6	http://msdn.microsoft.com/en-us/library/windows/desktop/ms725485.aspx
URLs in VB Code - #7	http://support.microsoft.com/kb/269370
URLs in VB Code - #8	http://www.ietf.org/rfc/rfc4627.txt
URLs in VB Code - #9	https://support.microsoft.com/en-us/kb/272138
URLs in VB Code - #10	http://www.vbaccelerator.com/home/VB/Code/Techniques/RunTime_Debug_Tracing/VB6_Tracer_Utility_zip_cStringBuilder_cls.asp
URLs in VB Code - #11	https://github.com/VBA-tools/VBA-JSON/pull/82
URLs in VB Code - #12	https://github.com/VBA-tools/VBA-UtcConverter
Remote Template - Highly Suspicious	file:///C:\Users\ashutosh.khaitan\Desktop\Worksheet%20in%20SRS_Offline_GSTR10_30052018.xls
Remote Template - Highly Suspicious	file:///C:\Users\pallav_yadav\Documents\GSTR_4_Offline_Utility_v3.0_new_PY.xls
Remote Template - Highly Suspicious	file:///C:\Users\richi.jain\AppData\Local\Temp\Temp1_GSTR_4_Offline_Utility.zip\GSTR_4_Offline_Utility_v3.0.xls

b572151155cdb30aa3c5096071720dbf (592.07 KB)

File Structure

CSHA256

Signing_Module

Characteristics

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	Sheet2	VBA Macro
	Sheet3	VBA Macro
	Sheet5	VBA Macro
	Sheet7	VBA Macro
	CSHA256	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Module1	VBA Macro
	Sheet10	VBA Macro
	Sheet12	VBA Macro
	Sheet16	VBA Macro
	Sheet17	VBA Macro
	Sheet23	VBA Macro
	Sheet25	VBA Macro
	FileUtil	VBA Macro
	PDF_Module	Blacklist VBA VBA Macro
	ValidateMod	VBA Macro
	Hashing_JSON	VBA Macro
	ThisWorkbook	VBA Macro
	Common_Module	Blacklist VBA VBA Macro
	JsonConverter	Blacklist VBA VBA Macro
	Signing_Module	Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Import_Error_JSON	VBA Macro
	Export_JSON_Module	Blacklist VBA VBA Macro
	Import_JSON_Module	VBA Macro
	Validate_Functions	VBA Macro
	Variable_Initialize	VBA Macro

Malware Configuration - Remote Template

Config. Field0	Value
Target	file:///C:\Users\ashutosh.khaitan\Desktop\Worksheet%20in%20SRS_Offline_GSTR10_30052018.xls
Path	externalLink2.xml.rels
XPath	/Relationships/Relationship
Outer XML	<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/externalLinkPath" Target="file:///C:\Users\ashutosh.khaitan\Desktop\Worksheet%20in%20SRS_Offline_GSTR10_30052018.xls" TargetMode="External" xmlns="http://schemas.openxmlformats.org/package/2006/relationships" />

Malware Configuration - Remote Template

Config. Field0	Value
Target	file:///C:\Users\pallav_yadav\Documents\GSTR_4_Offline_Utility_v3.0_new_PY.xls
Path	externalLink3.xml.rels
XPath	/Relationships/Relationship
Outer XML	<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/externalLinkPath" Target="file:///C:\Users\pallav_yadav\Documents\GSTR_4_Offline_Utility_v3.0_new_PY.xls" TargetMode="External" xmlns="http://schemas.openxmlformats.org/package/2006/relationships" />

Malware Configuration - Remote Template

Config. Field0	Value
Target	file:///C:\Users\richi.jain\AppData\Local\Temp\Temp1_GSTR_4_Offline_Utility.zip\GSTR_4_Offline_Utility_v3.0.xls
Path	externalLink1.xml.rels
XPath	/Relationships/Relationship
Outer XML	<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/externalLinkPath" Target="file:///C:\Users\richi.jain\AppData\Local\Temp\Temp1_GSTR_4_Offline_Utility.zip\GSTR_4_Offline_Utility_v3.0.xls" TargetMode="External" xmlns="http://schemas.openxmlformats.org/package/2006/relationships" />

Artefacts

Name0	Value	Location
URLs in VB Code - #1	https://github.com/VBA-tools/VBA-JSON	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #2	http://www.opensource.org/licenses/mit-license.php	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #3	http://code.google.com/p/vba-json/	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #4	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724421.aspx	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #5	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724949.aspx	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #6	http://msdn.microsoft.com/en-us/library/windows/desktop/ms725485.aspx	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #7	http://support.microsoft.com/kb/269370	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #8	http://www.ietf.org/rfc/rfc4627.txt	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #9	https://support.microsoft.com/en-us/kb/272138	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #10	http://www.vbaccelerator.com/home/VB/Code/Techniques/RunTime_Debug_Tracing/VB6_Tracer_Utility_zip_cStringBuilder_cls.asp	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #11	https://github.com/VBA-tools/VBA-JSON/pull/82	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #12	https://github.com/VBA-tools/VBA-UtcConverter	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #13	http://s	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #14	http://www.frez.co.uk	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin
URLs in VB Code - #1	http://www.frez.co.uk	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > CSHA256 > [Stored VBA]
URLs in VB Code - #1	http://www.frez.co.uk	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > CSHA256 > [Decompiled VBA]
URLs in VB Code - #1	https://github.com/VBA-tools/VBA-JSON	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter
URLs in VB Code - #2	http://www.opensource.org/licenses/mit-license.php	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter
URLs in VB Code - #3	http://code.google.com/p/vba-json/	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter
URLs in VB Code - #4	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724421.aspx	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter
URLs in VB Code - #5	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724949.aspx	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter
URLs in VB Code - #6	http://msdn.microsoft.com/en-us/library/windows/desktop/ms725485.aspx	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter
URLs in VB Code - #7	http://support.microsoft.com/kb/269370	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter
URLs in VB Code - #8	http://www.ietf.org/rfc/rfc4627.txt	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter
URLs in VB Code - #9	https://support.microsoft.com/en-us/kb/272138	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter
URLs in VB Code - #10	http://www.vbaccelerator.com/home/VB/Code/Techniques/RunTime_Debug_Tracing/VB6_Tracer_Utility_zip_cStringBuilder_cls.asp	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter
URLs in VB Code - #11	https://github.com/VBA-tools/VBA-JSON/pull/82	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter
URLs in VB Code - #12	https://github.com/VBA-tools/VBA-UtcConverter	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter
URLs in VB Code - #13	http://s	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter
URLs in VB Code - #1	https://github.com/VBA-tools/VBA-JSON	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Stored VBA]
URLs in VB Code - #2	http://www.opensource.org/licenses/mit-license.php	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Stored VBA]
URLs in VB Code - #3	http://code.google.com/p/vba-json/	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Stored VBA]
URLs in VB Code - #4	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724421.aspx	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Stored VBA]
URLs in VB Code - #5	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724949.aspx	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Stored VBA]
URLs in VB Code - #6	http://msdn.microsoft.com/en-us/library/windows/desktop/ms725485.aspx	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Stored VBA]
URLs in VB Code - #7	http://support.microsoft.com/kb/269370	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Stored VBA]
URLs in VB Code - #8	http://www.ietf.org/rfc/rfc4627.txt	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Stored VBA]
URLs in VB Code - #9	https://support.microsoft.com/en-us/kb/272138	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Stored VBA]
URLs in VB Code - #10	http://www.vbaccelerator.com/home/VB/Code/Techniques/RunTime_Debug_Tracing/VB6_Tracer_Utility_zip_cStringBuilder_cls.asp	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Stored VBA]
URLs in VB Code - #11	https://github.com/VBA-tools/VBA-JSON/pull/82	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Stored VBA]
URLs in VB Code - #12	https://github.com/VBA-tools/VBA-UtcConverter	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Stored VBA]
URLs in VB Code - #1	https://github.com/VBA-tools/VBA-JSON	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Decompiled VBA]
URLs in VB Code - #2	http://www.opensource.org/licenses/mit-license.php	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Decompiled VBA]
URLs in VB Code - #3	http://code.google.com/p/vba-json/	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Decompiled VBA]
URLs in VB Code - #4	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724421.aspx	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Decompiled VBA]
URLs in VB Code - #5	http://msdn.microsoft.com/en-us/library/windows/desktop/ms724949.aspx	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Decompiled VBA]
URLs in VB Code - #6	http://msdn.microsoft.com/en-us/library/windows/desktop/ms725485.aspx	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Decompiled VBA]
URLs in VB Code - #7	http://support.microsoft.com/kb/269370	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Decompiled VBA]
URLs in VB Code - #8	http://www.ietf.org/rfc/rfc4627.txt	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Decompiled VBA]
URLs in VB Code - #9	https://support.microsoft.com/en-us/kb/272138	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Decompiled VBA]
URLs in VB Code - #10	http://www.vbaccelerator.com/home/VB/Code/Techniques/RunTime_Debug_Tracing/VB6_Tracer_Utility_zip_cStringBuilder_cls.asp	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Decompiled VBA]
URLs in VB Code - #11	https://github.com/VBA-tools/VBA-JSON/pull/82	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Decompiled VBA]
URLs in VB Code - #12	https://github.com/VBA-tools/VBA-UtcConverter	b572151155cdb30aa3c5096071720dbf > xl > vbaProject.bin > Root Entry > VBA > JsonConverter > [Decompiled VBA]
Remote Template - Highly Suspicious	file:///C:\Users\ashutosh.khaitan\Desktop\Worksheet%20in%20SRS_Offline_GSTR10_30052018.xls Malicious	b572151155cdb30aa3c5096071720dbf > xl > externalLinks > _rels > externalLink2.xml.rels
Remote Template - Highly Suspicious	file:///C:\Users\pallav_yadav\Documents\GSTR_4_Offline_Utility_v3.0_new_PY.xls Malicious	b572151155cdb30aa3c5096071720dbf > xl > externalLinks > _rels > externalLink3.xml.rels
Remote Template - Highly Suspicious	file:///C:\Users\richi.jain\AppData\Local\Temp\Temp1_GSTR_4_Offline_Utility.zip\GSTR_4_Offline_Utility_v3.0.xls Malicious	b572151155cdb30aa3c5096071720dbf > xl > externalLinks > _rels > externalLink1.xml.rels

You must be signed in to post a comment.

b572151155cdb30aa3c5096071720dbf

MS Excel Document | MD5: b572151155cdb30aa3c5096071720dbf | Size: 592.07 KB | application/vnd.ms-excel

MS Excel Document
|
MD5: b572151155cdb30aa3c5096071720dbf
|
Size: 592.07 KB
|
application/vnd.ms-excel