Malicious
Malicious

dbec4cbbca0c6a96aa850f78d6d1d6f5

Share on LinkedIn
Print
VBScript
MD5: dbec4cbbca0c6a96aa850f78d6d1d6f5
Size: 304.64 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 dbec4cbbca0c6a96aa850f78d6d1d6f5
Sha1 033ccf7fed8225b18895632e22a4ab4a91cf4237
Sha256 ad146d279e3e91c5969831ead77123ada2c5a09bf5409810db843ed45e9b1cb8
Sha384 b30eb155660147b3acf3a2fe235eb0e6014a7cd925aeffbf080b3199fb08a111be4073b6ce343e5e1079ebc55037795e
Sha512 9f397e9d591a9389fbb999d86e2ee5a365c9146129245fcfdf1a43659f4030306f774e32cb7be7d43d43284fd9d31cb34cee73ec1c35ecc0a407c02069c5115a
SSDeep 6144:WxEtjPOtioVjDGUU1qfDlavx+U6g6777Ytneg3g7YX43RG:kYtne9
TLSH 2A5485C07B85C91EC61485758E9652DA7B72EC028B22E74731C3B7BF7EB25A09DC3285
dbec4cbbca0c6a96aa850f78d6d1d6f5
Malicious
Root Entry
CompObj
Workbook
SummaryInformation
DocumentSummaryInformation
_VBA_PROJECT_CUR
PROJECT
PROJECTwm
VBA
dir
Sheet1

Sheet1

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
__SRP_0
__SRP_1
__SRP_2
__SRP_3
__SRP_4
__SRP_5
UserForm1

UserForm1

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
_VBA_PROJECT
EmbedPictures_Macros
[Stored VBA]
Malicious
[Stored VBA].deobfuscated.vbs
[PCode]
Clear_and_Compress_Macros
[Stored VBA]
Malicious
[PCode]
UserForm1
f
o
CompObj
VBFrame
MsoDataStore
ÈÇÍØFÂÚSÐÔOÞJ4FÍÅGÂÜÄQ==
Item
Properties
ÛÆÌJÞMØÝÆÔ0ÏACÜÅ1ÛSVGA==
Item
Properties
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path ole:doc~T1059.005>bin
Shape ole:doc>bin
technique2 nodes
Path ole:doc~T1059.005>ole:vba
Shape ole:doc>ole:vba
technique2 nodes
An error has occurred. This application may no longer respond until reloaded. Reload 🗙