Deep Malware Analysis of bd7cbe6ec3a7b3099f748d097955f310 | md5: bd7cbe6ec3a7b3099f748d097955f310 | Office Document | Blacklist VBA | T1059.005 | Scripting.FileSystemObject | DeObfuscated | VBScript | Obfuscated | T1027 | COM Behavior Trace

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	bd7cbe6ec3a7b3099f748d097955f310
Sha1	a2d02522dd54539462086b16e71b8bdda6ce58aa
Sha256	60ef547ebd2f4252e286db762980481b0da23dcd2c84465509735544c0a9c2b3
Sha384	c46a76711b7a99ff4160ca5c9d13eea29efa0487cc039218c2787d465a8923c92288fb050a1913b63d5fe08ff1c12e73
Sha512	d0da75eeb7e6b5b47f4afd9f4b23b9048e9582990abfc6d3d46eb99bff58110af06577b45809ff4d56f13c1c079f3129c547b6e65702dca04c125c09472fc665
SSDeep	768:LhXHc+L/rbCwXAj4p4NxllNRiuqGzlrdxEuUEgXc:tTL/rbtXAsMBriE5TEuUER
TLSH	FAF2D00CE459B06BC783167CF1B985E9F27049479A2364DC0D09FB9D8F70587AB4AB8D

Module1

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 4secondary ignored: 6

bin 1img 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path oox:docm>oox:vba~T1027~T1059.005

Shape oox:docm>oox:vba

malicious 2 nodes

Path oox:docm>ole:doc~T1059.005

Shape oox:docm>ole:doc

technique2 nodes

Dropped path (COM trace) #1 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #2 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #3 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #4 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #5 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #6 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #7 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

	Module Name0
	Module1	Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.