Deep Malware Analysis of c34d10c7f93dc9272b4010e560b41759 | md5: c34d10c7f93dc9272b4010e560b41759 | Office Document | VBA Stomping | ATT&CK T1564.007 | Malicious | Malicious Document | Blacklist VBA | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | SOS: 0.22 | SOS: 0.48 | SOS: 0.29 | SOS: 0.23 | SOS: 0.32 | COM Behavior Trace | SOS: 0.40 | SOS: 0.28 | SOS: 0.35

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	c34d10c7f93dc9272b4010e560b41759
Sha1	c69cec1784de3ebba62aac00975e3fc66f231e52
Sha256	d1ec65537dafbe0e6255892622464983cd890de6348b79ef1977a4b03b0f23c4
Sha384	78a5299fd6b9d9037bd9dc29801bbf58c80452ccc174904611d08ed28a0fe47f216e9a4108d67821f93b0f4b7b1d84fe
Sha512	2fc239af17532be1b0c7e45095616cb8bae2974a3e748576538d7e4e0fc83b0dcced30533dc4dd8dc914eff0f95d5298ee836e338fb4eec8fdf3cb801721006f
SSDeep	6144:7k3hbdlylKsgqopeJBWhZFVE+W2NdMPyzqJSaVZjEir+Pmro8YbLoLohHeKbu6Y+:zyWIaf4Q+/8FLosqa84JIj+aP9JH
TLSH	69E46C09B155C43BC99946314C96D6EABE70BC035F4EB3CB36487BAE3E7A7209B06750

c34d10c7f93dc9272b4010e560b41759

Malicious

Root Entry

Malicious

CompObj

Workbook

SummaryInformation

DocumentSummaryInformation

_VBA_PROJECT_CUR

Malicious

PROJECT

PROJECTwm

VBA

Malicious

dir

Module1

Malicious

Module1

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module2

Malicious

Module2

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module3

Module3

[Stored VBA]

Malicious

[PCode]

Module4

Malicious

Module4

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module5

Module5

[Stored VBA]

Malicious

[PCode]

Module6

Malicious

Module6

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module7

Malicious

Module7

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module8

Module8

[Stored VBA]

Malicious

[PCode]

Module9

Malicious

Module9

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

__SRP_0

__SRP_1

__SRP_2

__SRP_3

__SRP_4

__SRP_5

__SRP_6

__SRP_7

__SRP_8

__SRP_9

__SRP_c

__SRP_d

__SRP_e

__SRP_f

Module10

Malicious

Module10

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module11

Malicious

Module11

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module12

Malicious

Module12

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

__SRP_10

__SRP_11

__SRP_12

__SRP_13

__SRP_14

__SRP_15

__SRP_16

__SRP_17

ThisWorkbook

ThisWorkbook

[Stored VBA]

Malicious

[PCode]

[Decompiled VBA]

Malicious

_VBA_PROJECT

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

7 / 7

Path ole:doc~T1027~T1059.005~T1564.007>bin

Shape ole:doc>bin

malicious 2 nodes

Path ole:doc~T1027~T1059.005~T1564.007>ole:vba

Shape ole:doc>ole:vba

malicious 2 nodes

Trace COM ordonnée UNKNWOWNmalicious

line 4huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 2huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 6huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

c34d10c7f93dc9272b4010e560b41759

Malicious

Root Entry

Malicious

CompObj

Workbook

SummaryInformation

DocumentSummaryInformation

_VBA_PROJECT_CUR

Malicious

PROJECT

PROJECTwm

VBA

Malicious

dir

Module1

Malicious

Module1

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module2

Malicious

Module2

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module3

Module3

[Stored VBA]

Malicious

[PCode]

Module4

Malicious

Module4

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module5

Module5

[Stored VBA]

Malicious

[PCode]

Module6

Malicious

Module6

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module7

Malicious

Module7

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module8

Module8

[Stored VBA]

Malicious

[PCode]

Module9

Malicious

Module9

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

__SRP_0

__SRP_1

__SRP_2

__SRP_3

__SRP_4

__SRP_5

__SRP_6

__SRP_7

__SRP_8

__SRP_9

__SRP_c

__SRP_d

__SRP_e

__SRP_f

Module10

Malicious

Module10

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module11

Malicious

Module11

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module12

Malicious

Module12

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

__SRP_10

__SRP_11

__SRP_12

__SRP_13

__SRP_14

__SRP_15

__SRP_16

__SRP_17

ThisWorkbook

ThisWorkbook

[Stored VBA]

Malicious

[PCode]

[Decompiled VBA]

Malicious

_VBA_PROJECT

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	Module1	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Module2	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Module3	VBA Macro
	Module4	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module5	VBA Macro
	Module6	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module7	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module8	Blacklist VBA VBA Macro
	Module9	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module10	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module11	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module12	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	ThisWorkbook	VBA Macro

No malware configuration was found at this point.

Trace COM ordonnée UNKNWOWNmalicious

line 4huhuhuhuhuhuhuhuhuhuhu

c34d10c7f93dc9272b4010e560b41759 › Root Entry › _VBA_PROJECT_CUR › VBA › Module6 › [Full Diff]

Trace COM ordonnée UNKNWOWNmalicious

line 2huhuhuhuhuhuhuhuhuhuhu

c34d10c7f93dc9272b4010e560b41759 › Root Entry › _VBA_PROJECT_CUR › VBA › Module7 › [Stored VBA]

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

c34d10c7f93dc9272b4010e560b41759 › Root Entry › _VBA_PROJECT_CUR › VBA › Module7 › [Full Diff]

Trace COM ordonnée UNKNWOWNmalicious

line 6huhuhuhuhuhuhuhuhuhuhu

c34d10c7f93dc9272b4010e560b41759 › Root Entry › _VBA_PROJECT_CUR › VBA › Module2 › [Stored VBA]

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.

You need a premium account to access this feature.

You must be signed in to post a comment.