Deep Malware Analysis of ce37733a06f8241a9c154fc6dbbd7961 | md5: ce37733a06f8241a9c154fc6dbbd7961 | Office Document | VBA Stomping | ATT&CK T1564.007 | Malicious | Malicious Document | Blacklist VBA | T1059.005 | DeObfuscated | VBScript | Obfuscated | T1027 | Shell.Application | Excel.sheet | Scripting.FileSystemObject

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	ce37733a06f8241a9c154fc6dbbd7961
Sha1	e18c9c4e8078384f260691197d5b9f97b5fcec4a
Sha256	aa35fc0f401673c49ade59da35761175d5de7cbc1fe3537bbd2c0a5401468920
Sha384	f84c0e1cef952f10ee9be55e1d2df3514669517f88a3c0a348396c269def3f349b9d89477856e4d36e58f6824551f634
Sha512	ddab177b03665facfe705a3695f39ae05bbf26181f2b4155c5053ff2893ecf8f6e4d848423d9b1e3aaaf4d4a9c6181f7049dae54b7e73c96d815b569fcfb0e11
SSDeep	12288:8poA8COkjk6+/E1UJxgxqWOr2/28+Eecj9HleuxdYZ0:woBkIj/AGxKqWc2uZEe6F7x20
TLSH	3EC4231AD301FC49CB1358BF941CD5A33E866C995006FB4F3941F6AE07A61CE87EE2A5

CSHA256

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

15 / 15

Path oox:xlsm~T1027~T1059.005~T1564.007>oox:media>img

Shape oox:xlsm>oox:media>img

malicious 3 nodes

Path oox:xlsm~T1027~T1059.005~T1564.007>bin

Shape oox:xlsm>bin

malicious 2 nodes

	Module Name0
	CSHA256	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Sheet17	VBA Macro