Malicious MS Office Document analysis – cf698dfd1283

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

24 malicious · 84 files

OFFvbaProject.binMS Office DocumentT1059.005 · ATT&CK T1564.007

BINRoot Entry

BINPROJECTextracted from MS Office Document

BINPROJECTwmextracted from MS Office Document

BINDPB

BINVBA

BINdirextracted from MS Office Document

VBADPBsub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

VBAMy_Codesub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScriptT1059.005

VBS[Stored VBA].deobfuscated.vbsdeobfuscated · VBScriptT1059.005

VBA[PCode]disassembled · VBA Module

VBASheet24sub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

BIN__SRP_0extracted from MS Office Document

BIN__SRP_1extracted from MS Office Document

BIN__SRP_2extracted from MS Office Document

BIN__SRP_3extracted from MS Office Document

BIN__SRP_4extracted from MS Office Document

BIN__SRP_5extracted from MS Office Document

BIN__SRP_6extracted from MS Office Document

BIN__SRP_7extracted from MS Office Document

BIN__SRP_8extracted from MS Office Document

BIN__SRP_9extracted from MS Office Document

BIN__SRP_aextracted from MS Office Document

BIN__SRP_bextracted from MS Office Document

BIN__SRP_eextracted from MS Office Document

BIN__SRP_fextracted from MS Office Document

BIN__SRP_10extracted from MS Office Document

BIN__SRP_11extracted from MS Office Document

VBACustomMenusub-stream · VBA Module

VBACustomGroupsub-stream · VBA Module

VBAImageribbonsub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

VBACustomButtonsub-stream · VBA Module

VBAIntroductionsub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

VBARibbonUpdatesub-stream · VBA ModuleATT&CK T1564.007

VBS[Stored VBA]code extracted · VBScriptT1059.005 · ATT&CK T1564.007

VBS[Stored VBA].deobfuscated.vbsdeobfuscated · VBScriptT1059.005

VBA[PCode]disassembled · VBA ModuleATT&CK T1564.007

VBS[Decompiled VBA]decompiled · VBScriptT1059.005 · ATT&CK T1564.007

VBS[Decompiled VBA].deobfuscated.vbsdeobfuscated · VBScriptT1059.005

VBS[Full Diff]generated · VBScriptATT&CK T1564.007

VBA[Partial Diff]generated · VBA ModuleATT&CK T1564.007

VBAThisWorkbooksub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

VBAUpdateSheetssub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

BIN_VBA_PROJECTextracted from MS Office Document

VBACustomRibbonTabsub-stream · VBA Module

VBARibbonObjectsDefinedsub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

BINIntroduction

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

24 malicious · 84 files

OFFvbaProject.binMS Office DocumentT1059.005 · ATT&CK T1564.007

BINRoot Entry

BINPROJECTextracted from MS Office Document

BINPROJECTwmextracted from MS Office Document

BINDPB

BINVBA

BINdirextracted from MS Office Document

VBADPBsub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

VBAMy_Codesub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScriptT1059.005

VBS[Stored VBA].deobfuscated.vbsdeobfuscated · VBScriptT1059.005

VBA[PCode]disassembled · VBA Module

VBASheet24sub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

BIN__SRP_0extracted from MS Office Document

BIN__SRP_1extracted from MS Office Document

BIN__SRP_2extracted from MS Office Document

BIN__SRP_3extracted from MS Office Document

BIN__SRP_4extracted from MS Office Document

BIN__SRP_5extracted from MS Office Document

BIN__SRP_6extracted from MS Office Document

BIN__SRP_7extracted from MS Office Document

BIN__SRP_8extracted from MS Office Document

BIN__SRP_9extracted from MS Office Document

BIN__SRP_aextracted from MS Office Document

BIN__SRP_bextracted from MS Office Document

BIN__SRP_eextracted from MS Office Document

BIN__SRP_fextracted from MS Office Document

BIN__SRP_10extracted from MS Office Document

BIN__SRP_11extracted from MS Office Document

VBACustomMenusub-stream · VBA Module

VBACustomGroupsub-stream · VBA Module

VBAImageribbonsub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

VBACustomButtonsub-stream · VBA Module

VBAIntroductionsub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

VBARibbonUpdatesub-stream · VBA ModuleATT&CK T1564.007

VBS[Stored VBA]code extracted · VBScriptT1059.005 · ATT&CK T1564.007

VBS[Stored VBA].deobfuscated.vbsdeobfuscated · VBScriptT1059.005

VBA[PCode]disassembled · VBA ModuleATT&CK T1564.007

VBS[Decompiled VBA]decompiled · VBScriptT1059.005 · ATT&CK T1564.007

VBS[Decompiled VBA].deobfuscated.vbsdeobfuscated · VBScriptT1059.005

VBS[Full Diff]generated · VBScriptATT&CK T1564.007

VBA[Partial Diff]generated · VBA ModuleATT&CK T1564.007

VBAThisWorkbooksub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

VBAUpdateSheetssub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

BIN_VBA_PROJECTextracted from MS Office Document

VBACustomRibbonTabsub-stream · VBA Module

VBARibbonObjectsDefinedsub-stream · VBA Module

VBS[Stored VBA]code extracted · VBScript

VBA[PCode]disassembled · VBA Module

VBS[Decompiled VBA]decompiled · VBScript

BINIntroduction

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	DPB	VBA Macro
	My_Code	VBA Macro
	Sheet24	VBA Macro
	CustomMenu	VBA Macro
	CustomGroup	VBA Macro
	Imageribbon	VBA Macro
	CustomButton	VBA Macro
	Introduction	VBA Macro
	RibbonUpdate	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	ThisWorkbook	VBA Macro
	UpdateSheets	VBA Macro
	CustomRibbonTab	VBA Macro
	RibbonObjectsDefined	VBA Macro

No malware configuration was found at this point.

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

vbaProject.bin

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

vbaProject.bin

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

Coming soon: export of this report's indicators to MISP and EDR platforms.