c75dc1096421f34fb07209fab507facf

MS Excel Document

MD5: c75dc1096421f34fb07209fab507facf

Size: 125.59 KB

application/vnd.ms-excel

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	c75dc1096421f34fb07209fab507facf
Sha1	21b98f5c2e88ebb6df1a4e62d59b968bc7bc7836
Sha256	c29066f832baeeb36abe9415dba3b9f2d6b95030caad2fda17390f412c674e6e
Sha384	b6d81e984a54d16cdbb7fe4fa46844788e71cba2dbc2a79c6599526378e892e6b89774cbe74983c442ccf8dc5abe0ac7
Sha512	e21fb6333010cb23e4e6c1c0aafb11ac078cc8a53457e28caf1a8a3db117152000e6f0275c564bf74cc2d537d0918d32ce647eacf49c15da04374cbcfa50052b
SSDeep	3072:gFT4OgGr7QNiNaIVqeJelwvxaKDWOmbcTP5vWnNpWA71dYDTn:2zLrcNicIpjvxdOSP5vWnNodH
TLSH	50C3022CA9446C4EED87BBBCD14829F1535EAB9844556F1F51C1E2CE4F501DBA38C2DC

Module2

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	Module1	VBA Macro
	Module2	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Module3	VBA Macro
	Module4	Blacklist VBA VBA Macro
	Module5	VBA Macro

No malware configuration was found at this point.

You must be signed in to view YARA rules.