Malicious
ca92ffaa066de4a811e0ae179c1adbc2
MS Excel Document
MD5: ca92ffaa066de4a811e0ae179c1adbc2
Size: 849.24 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | ca92ffaa066de4a811e0ae179c1adbc2 |
| Sha1 | 4605fc8647d1027234894d3b72f7eb4aabb00590 |
| Sha256 | 7ea9628a6d531b6d190d3333aadf636aae7b87de423ab6975a92dabcf7fbf5f8 |
| Sha384 | 02e13f615a5ce1c6554443e26ab999d6d800e974c5ba7a383a905aa0bafe55a97b4316f440eac50cd167d323fa49a6f4 |
| Sha512 | 3e0a5b9f0104a7218de647703159887d34d91ddfb0f7b0394e9cd4931b667bff9d9f3a16485896307aaea8f5eaeedf059c60dcd0cbe5581626ff97b42bd44017 |
| SSDeep | 12288:gLylMDadzn89+xamtgnZ+xTru0nTlOvchowFQcCbPYLuNTiCw317rvglDVCobOA2:guJ5nXMZi/n5OvchvQpJGCwvc2pBz |
| TLSH | DC05122DF726899DCF2A943CC00803D79D0E595784E1A85E1E94BB443B5A4FF8F8E4AD |
Malicious
Malicious
Malicious
Malicious
frmProgress
frmPwdInput
MxlParseXml
frmTemplates
Malicious
ConvSheetToNode
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
15 / 15
Path
oox:xlsm~T1027~T1059.005~T1564.007>oox:media>img
Shape
oox:xlsm>oox:media>img
malicious
3 nodes
Path
oox:xlsm~T1027~T1059.005~T1564.007>bin
Shape
oox:xlsm>bin
malicious
2 nodes
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
fihuhuhuhu
URLs in VB Code - #1
URIsuspect
fihuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
Malicious
Malicious
Malicious
frmProgress
frmPwdInput
MxlParseXml
frmTemplates
Malicious
ConvSheetToNode
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › MxMifService › [Full Diff]
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › MxMifService › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › MxMifService › [Stored VBA]
URLs in VB Code - #1
URIsuspect
fihuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › MxNodeAttr › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
fihuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › MxNodeAttr › [Stored VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmRegWarn › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmRegWarn › [Stored VBA]
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmExport › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmExport › [Stored VBA]
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmError › [Decompiled VBA]
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmError › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmError › [Stored VBA]
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmError › [Stored VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Decompiled VBA]
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Decompiled VBA]
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Decompiled VBA]
URLs in VB Code - #4
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Decompiled VBA]
URLs in VB Code - #5
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Stored VBA]
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Stored VBA]
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Stored VBA]
URLs in VB Code - #4
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Stored VBA]
URLs in VB Code - #5
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › frmAbout › [Stored VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › Main › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › Main › [Stored VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › vbaProject.bin › Root Entry › VBA › Reg
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › worksheets › _rels › sheet1.xml.rels
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › worksheets › _rels › sheet1.xml.rels
Remote Resource Reference
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › worksheets › _rels › sheet1.xml.rels
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ca92ffaa066de4a811e0ae179c1adbc2 › xl › worksheets › _rels › sheet1.xml.rels
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.