Malicious ZIP Archive analysis – c90a0dd545e1

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

ZIP archive

11 malicious · 239 files

ZIP3c2ea5443683e0be4f0c950d4ea7109c3315ff4dbc8feda6f1e31320f8d7c605_password_infected.zipZIP ArchiveT1059.005

TXTfilename.txtextracted from ZIP Archive

XLS3c2ea5443683e0be4f0c950d4ea7109c3315ff4dbc8feda6f1e31320f8d7c605.binextracted from ZIP Archive · MS Excel DocumentT1059.005

XML[Content_Types].xmlextracted from MS Excel Document · XML

BIN_rels

BINxl

XMLworkbook.xmlextracted from MS Excel Document · XML

BIN_rels

BINworksheets

BINdrawings

BINtheme

XMLstyles.xmlextracted from MS Excel Document · XML

XMLsharedStrings.xmlextracted from MS Excel Document · XML

BINmedia

OFFvbaProject.binextracted from MS Excel Document · MS Office Document

BINRoot Entry

BINPROJECTextracted from MS Office Document

BINPROJECTwmextracted from MS Office Document

BINVBA

BINdirextracted from MS Office Document

VBAModule1sub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

VBAModule2sub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScriptT1059.005

VBS[Stored VBA].deobfuscated.vbsdeobfuscated · VBScriptT1059.005

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

VBAModule3sub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBAModule4sub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

BIN__SRP_0extracted from MS Office Document

BIN__SRP_1extracted from MS Office Document

BIN__SRP_2extracted from MS Office Document

BIN__SRP_3extracted from MS Office Document

BIN__SRP_4extracted from MS Office Document

BIN__SRP_5extracted from MS Office Document

BIN__SRP_6extracted from MS Office Document

BIN__SRP_7extracted from MS Office Document

BIN__SRP_8extracted from MS Office Document

BIN__SRP_9extracted from MS Office Document

BIN__SRP_aextracted from MS Office Document

BIN__SRP_bextracted from MS Office Document

BIN__SRP_cextracted from MS Office Document

BIN__SRP_dextracted from MS Office Document

BIN__SRP_eextracted from MS Office Document

BIN__SRP_fextracted from MS Office Document

BIN__SRP_10extracted from MS Office Document

BIN__SRP_11extracted from MS Office Document

BIN__SRP_12extracted from MS Office Document

BIN__SRP_13extracted from MS Office Document

BIN__SRP_14extracted from MS Office Document

BIN__SRP_15extracted from MS Office Document

BIN__SRP_16extracted from MS Office Document

BIN__SRP_17extracted from MS Office Document

BIN__SRP_18extracted from MS Office Document

BIN__SRP_19extracted from MS Office Document

BIN__SRP_1aextracted from MS Office Document

BIN__SRP_1bextracted from MS Office Document

BIN__SRP_1cextracted from MS Office Document

BIN__SRP_1dextracted from MS Office Document

BIN__SRP_1eextracted from MS Office Document

BIN__SRP_1fextracted from MS Office Document

VBAAR_ERDA_1sub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScriptT1059.005

VBS[Decompiled VBA].deobfuscated.vbsdeobfuscated · VBScriptT1059.005

VBAThisWorkbooksub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

BIN_VBA_PROJECTextracted from MS Office Document

BINexternalLinks

XMLmetadata.xmlextracted from MS Excel Document · XML

BINprinterSettings

BINactiveX

BINctrlProps

BINtables

XMLcalcChain.xmlextracted from MS Excel Document · XML

XMLcomments1.xmlextracted from MS Excel Document · XML

BINcustomXml

BINdocProps

Remote Resource Reference URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

11 malicious · 239 files

ZIP3c2ea5443683e0be4f0c950d4ea7109c3315ff4dbc8feda6f1e31320f8d7c605_password_infected.zipZIP ArchiveT1059.005

TXTfilename.txtextracted from ZIP Archive

XLS3c2ea5443683e0be4f0c950d4ea7109c3315ff4dbc8feda6f1e31320f8d7c605.binextracted from ZIP Archive · MS Excel DocumentT1059.005

XML[Content_Types].xmlextracted from MS Excel Document · XML

BIN_rels

BINxl

XMLworkbook.xmlextracted from MS Excel Document · XML

BIN_rels

BINworksheets

BINdrawings

BINtheme

XMLstyles.xmlextracted from MS Excel Document · XML

XMLsharedStrings.xmlextracted from MS Excel Document · XML

BINmedia

OFFvbaProject.binextracted from MS Excel Document · MS Office Document

BINRoot Entry

BINPROJECTextracted from MS Office Document

BINPROJECTwmextracted from MS Office Document

BINVBA

BINdirextracted from MS Office Document

VBAModule1sub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

VBAModule2sub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScriptT1059.005

VBS[Stored VBA].deobfuscated.vbsdeobfuscated · VBScriptT1059.005

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

VBAModule3sub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBAModule4sub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

BIN__SRP_0extracted from MS Office Document

BIN__SRP_1extracted from MS Office Document

BIN__SRP_2extracted from MS Office Document

BIN__SRP_3extracted from MS Office Document

BIN__SRP_4extracted from MS Office Document

BIN__SRP_5extracted from MS Office Document

BIN__SRP_6extracted from MS Office Document

BIN__SRP_7extracted from MS Office Document

BIN__SRP_8extracted from MS Office Document

BIN__SRP_9extracted from MS Office Document

BIN__SRP_aextracted from MS Office Document

BIN__SRP_bextracted from MS Office Document

BIN__SRP_cextracted from MS Office Document

BIN__SRP_dextracted from MS Office Document

BIN__SRP_eextracted from MS Office Document

BIN__SRP_fextracted from MS Office Document

BIN__SRP_10extracted from MS Office Document

BIN__SRP_11extracted from MS Office Document

BIN__SRP_12extracted from MS Office Document

BIN__SRP_13extracted from MS Office Document

BIN__SRP_14extracted from MS Office Document

BIN__SRP_15extracted from MS Office Document

BIN__SRP_16extracted from MS Office Document

BIN__SRP_17extracted from MS Office Document

BIN__SRP_18extracted from MS Office Document

BIN__SRP_19extracted from MS Office Document

BIN__SRP_1aextracted from MS Office Document

BIN__SRP_1bextracted from MS Office Document

BIN__SRP_1cextracted from MS Office Document

BIN__SRP_1dextracted from MS Office Document

BIN__SRP_1eextracted from MS Office Document

BIN__SRP_1fextracted from MS Office Document

VBAAR_ERDA_1sub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScriptT1059.005

VBS[Decompiled VBA].deobfuscated.vbsdeobfuscated · VBScriptT1059.005

VBAThisWorkbooksub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

BIN_VBA_PROJECTextracted from MS Office Document

BINexternalLinks

XMLmetadata.xmlextracted from MS Excel Document · XML

BINprinterSettings

BINactiveX

BINctrlProps

BINtables

XMLcalcChain.xmlextracted from MS Excel Document · XML

XMLcomments1.xmlextracted from MS Excel Document · XML

BINcustomXml

BINdocProps

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	Module1	VBA Macro
	Module2	VBA Macro
	Module3	VBA Macro
	Module4	VBA Macro
	AR_ERDA_1	VBA Macro
	ThisWorkbook	VBA Macro

No malware configuration was found at this point.

Remote Resource Reference URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

3c2ea5443683e0be4f0c950d4ea7109c3315ff4dbc8feda6f1e31320f8d7c605_password_infected.zip › 3c2ea5443683e0be4f0c950d4ea7109c3315ff4dbc8feda6f1e31320f8d7c605.bin › xl › worksheets › _rels › sheet12.xml.rels

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhu

Remote Resource Reference URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhu

3c2ea5443683e0be4f0c950d4ea7109c3315ff4dbc8feda6f1e31320f8d7c605_password_infected.zip › 3c2ea5443683e0be4f0c950d4ea7109c3315ff4dbc8feda6f1e31320f8d7c605.bin › xl › vbaProject.bin

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

Coming soon: export of this report's indicators to MISP and EDR platforms.