Malicious MS Excel Document analysis – f0699a95fc39

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

226.69 KB · 226,688 B

First seen

2026-10-23 09:15 · 2 days ago

Last seen

2026-10-23 09:15 · 2 days ago

Last analysis

2026-10-23 09:15 · 2 days ago

Hashes

MD5 d83b39d6c5ac33231cfa9c4e8c71d7ba Sha1 689934fa0d314f7453a32275463f22171d629577 Sha256 f0699a95fc39bed963289229b613f2b4684ed034e28f8b355fe0b6825a01e774 Sha384 0f3a15cf1250fdfa9f9f0734ea3b3a92c42ba3333cbd60ab0b8729c274d54bd3d10daf8c9fb770341be48b40625e6308 Sha512 c5c19de538c8694801d1a54bbef47ce54dfd0d4605f34efa55f84b2cebb3470aadc88f4fae6e583d391d8393aa424d72ca4426c4480bf0717c44ef954970325a SSDeep 6144:lOfxVQhW0Q8LBGilAW86CTJFpbvesnoxK3V4tevYFyrZEfO:lO4hWXyAW2ZePY6tE4vfO TLSH B324E01399266ED3E11CD3F9BF1B0AEE1F155B49E586BEEB04609F89B3A00530D4E52C

19 malicious · 54 files

XLSd83b39d6c5ac33231cfa9c4e8c71d7ba

XML[Content_Types].xml

BIN_rels

BINxl

BIN_rels

XMLworkbook.xml

BINtheme

OFFvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

VBAModule1

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

VBAThisWorkbook

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBS[Full Diff]

VBS[Partial Diff]

BIN_VBA_PROJECT

BINworksheets

BINdrawings

BINmedia

XMLstyles.xml

XMLsharedStrings.xml

BINprinterSettings

BINdocProps

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

12 / 12

Path oox:xlsm~T1027~T1059.005~T1564.007>oox:media>img

Shape oox:xlsm>oox:media>img

malicious 3 nodes

Path oox:xlsm~T1027~T1059.005~T1564.007>bin

Shape oox:xlsm>bin

malicious 2 nodes

Trace COM ordonnée UNKNWOWNmalicious

line 2huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 4huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

	Module Name0
	Module1	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	ThisWorkbook	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.