cd91432e82f551fb46896b10efd5ca5d

MS Excel Document

MD5: cd91432e82f551fb46896b10efd5ca5d

Size: 641.36 KB

application/vnd.ms-excel

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

MD5	cd91432e82f551fb46896b10efd5ca5d
Sha1	bfcc327ba7e787272134102d72b319cb2d63b240
Sha256	2ff2e74e466cf2c1a230ecebdb3049225d5978c8330e0f601ccf02d53a76b578
Sha384	c40522af1299ba98cab9c5393e19eb9fb964887245917ef21e7e31b8dc809a77a2f39aa7ffd5b9ae62b346621d4b0d97
Sha512	0cfab547263c75ed27fa1d873760b2750f9ba0ffe9ed5be43d055e7a3a54dcf50a3579d5329d57f1189333340fd91b3f77546470c66de6bb17eea9ee144d7aae
SSDeep	12288:CLoqH/ixOBfXh4c5zdkaFwmmtWmnAUZapIC9U/6QiaHBdDn:+zphtdsSICBFeB9
TLSH	D0D42306C8B3F948C6BF583DF50C62E266DE8C115110FA8E3F61B0AC95B546F8B8A55F

CSHA256

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

14 / 14

Path oox:xlsm~T1027~T1059.005~T1564.007>oox:media>img

Shape oox:xlsm>oox:media>img

malicious 3 nodes

Path oox:xlsm~T1027~T1059.005~T1564.007>bin

Shape oox:xlsm>bin

malicious 2 nodes

CSHA256

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	CSHA256	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Sheet17	VBA Macro

No malware configuration was found at this point.

You must be signed in to view YARA rules.