Malicious
MS Excel Document
MD5: ca92ffaa066de4a811e0ae179c1adbc2
Size: 849.24 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
849.24 KB · 849,239 B
First seen
2026-08-05 13:01 · 2 months ago
Last seen
2026-08-05 13:01 · 2 months ago
Last analysis
2026-08-05 21:34 · 2 months ago
Hashes
MD5
ca92ffaa066de4a811e0ae179c1adbc2
Sha1
4605fc8647d1027234894d3b72f7eb4aabb00590
Sha256
7ea9628a6d531b6d190d3333aadf636aae7b87de423ab6975a92dabcf7fbf5f8
Sha384
02e13f615a5ce1c6554443e26ab999d6d800e974c5ba7a383a905aa0bafe55a97b4316f440eac50cd167d323fa49a6f4
Sha512
3e0a5b9f0104a7218de647703159887d34d91ddfb0f7b0394e9cd4931b667bff9d9f3a16485896307aaea8f5eaeedf059c60dcd0cbe5581626ff97b42bd44017
SSDeep
12288:gLylMDadzn89+xamtgnZ+xTru0nTlOvchowFQcCbPYLuNTiCw317rvglDVCobOA2:guJ5nXMZi/n5OvchvQpJGCwvc2pBz
TLSH
DC05122DF726899DCF2A943CC00803D79D0E595784E1A85E1E94BB443B5A4FF8F8E4AD
62 malicious · 295 files
XLSca92ffaa066de4a811e0ae179c1adbc2T1027 · T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
BINxl
XMLworkbook.xml
BIN_rels
BINworksheets
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
BINmedia
VBSvbaProject.binATT&CK T1564.007
BINRoot Entry
BINPROJECT
BINPROJECTlk
BINPROJECTwm
BINVBA
BINdir
VBSRegT1027 · T1059.005
VBS[Stored VBA]T1059.005
VBA[PCode]
VBSReg.deobfuscated.vbsT1059.005
VBSMain
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxNode
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSMxSheet
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxUtils
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAfrmAbout
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmError
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAfrmConnOk
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmExport
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmResult
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSfrmWizard
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxConfigH
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlConfig
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlLogger
VBSfrmRegWarn
VBS[Stored VBA]T1059.005
VBS[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlObjAttr
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxNodeAttr
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmProgress
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmPwdInput
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlParseXml
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAMxlPropFile
VBAfrmTemplates
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSMxlParseJson
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSMxMifServiceATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1027 · T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBS_VBA_PROJECTT1027 · T1059.005
VBS_VBA_PROJECT.deobfuscated.vbsT1059.005
VBAfrmResultQuery
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAConvNodeToSheet
VBS[Stored VBA]T1027 · T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAConvSheetToNode
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBSfrmProgressQuery
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAfrmProgressSynch
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
BINfrmAbout
BINfrmError
BINfrmConnOk
BINfrmExport
BINfrmResult
BINfrmWizard
BINfrmRegWarn
BINfrmProgress
BINfrmPwdInput
BINfrmTemplates
BINfrmResultQuery
BINfrmProgressQuery
BINfrmProgressSynch
XMLmetadata.xml
BINprinterSettings
BINctrlProps
XMLcomments1.xml
XMLcomments2.xml
BINtables
XMLcalcChain.xml
BINcustomXml
BINdocMetadata
BINdocProps
BINuserCustomization
BINcustomUI
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
15 / 15
Path
oox:xlsm~T1027~T1059.005~T1564.007>oox:media>img
Shape
oox:xlsm>oox:media>img
malicious
3 nodes
Path
oox:xlsm~T1027~T1059.005~T1564.007>bin
Shape
oox:xlsm>bin
malicious
2 nodes
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
fihuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Remote Resource Reference
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential