Deep Malware Analysis of c4fe9d9eeb8a6cb6744f4ab8b268616f | md5: c4fe9d9eeb8a6cb6744f4ab8b268616f | Office Document | Blacklist VBA | T1059.005 | Scripting.FileSystemObject | DeObfuscated | VBScript | Obfuscated | T1027 | COM Behavior Trace

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	c4fe9d9eeb8a6cb6744f4ab8b268616f
Sha1	f19a7fe003fcc58054a9d969b5a2b43e96d8a776
Sha256	6678049918dda2d5859de0a95e0573fec9496c62bbe72967ae0d3deeb5bda68f
Sha384	76c83cc4724237ac49b796ec472f016dbd84d3dabcb381fa0596df08ae71cc0633fbaff6354863ba6bed913580687cb4
Sha512	c0beab59bc5430462ecde47e5d454424b508c2fd64a9b61cd5378e0d64d12a2fa53cce08e9b48640218ca27e1dbf621718e13d06817a8b2392eaa9e489a9be43
SSDeep	768:LhjTI8O2H6E08AI4p4NxllNR7XkCzQwUrdxEuUE7Z:u8D6E08GMBr7XanTEuUE1
TLSH	10F2D03CF819B41AD6865A3C74E854DAF11846438222F8DA4A85F79DCF7098B9B07F4E

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 4secondary ignored: 6

bin 1img 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path oox:docm>oox:vba~T1027~T1059.005

Shape oox:docm>oox:vba

malicious 2 nodes

Path oox:docm>ole:doc~T1059.005

Shape oox:docm>ole:doc

technique2 nodes

Dropped path (COM trace) #1 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #2 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #3 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #4 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #5 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #6 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #7 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential