dcb4c95311d6c9f5519b1f66a0b5aa26

MS Excel Document

MD5: dcb4c95311d6c9f5519b1f66a0b5aa26

Size: 2.34 MB

application/vnd.ms-excel

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

2.34 MB · 2,337,149 B

First seen

2026-08-08 17:31 · 2 months ago

Last seen

2026-08-08 17:31 · 2 months ago

Last analysis

2026-08-08 17:31 · 2 months ago

Hashes

MD5 dcb4c95311d6c9f5519b1f66a0b5aa26 Sha1 094b4e277e07d60c6f2b31b629a503e55d3268a0 Sha256 9d66bfddb6058cd175177ae545831d76c64b2a9a41585d81cb83a54d0eaf210b Sha384 8a3c0bd0c7d0a1ee8e30928d3705e1053597f863aff9dd71dd67561a1720765f526f7a3ad1a623615315374d0c88f18b Sha512 42f0ab6f1091f507f59ffb602c65b418529d3eee319b05c13bb735a9fea6c42b30c54d07d223306ac2e6bb935dfb3e4ba0781b3cd0931981c0d59b44cc876036 SSDeep 49152:Mpsc2PGcXoKIJTQHC1O1WXELed/oh+A1hDIvlppikESOe8cR:MpscN1BUC1O1W0TspvYSOZi TLSH 1CB53322425B39F7D67E887B641CF8E52A0877C41089AC7A21D25C0B1775BEB9049FFE

14 malicious · 84 files

XLSdcb4c95311d6c9f5519b1f66a0b5aa26

XML[Content_Types].xml

BIN_rels

XML.rels

BINxl

XMLworkbook.xml

BIN_rels

XMLworkbook.xml.rels

BINworksheets

XMLsheet1.xml

XMLsheet2.xml

BIN_rels

XMLsheet1.xml.rels

BINtheme

XMLtheme1.xml

XMLstyles.xml

XMLsharedStrings.xml

BINdrawings

XMLdrawing1.xml

BIN_rels

XMLdrawing1.xml.rels

BINmedia

IMGimage1.png

IMGimage1.png-preview.png

VBSvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

VBAModule1

VBS[Stored VBA]

VBA[PCode]

VBAModule2

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBSModule3

VBS[Stored VBA]

VBS[PCode]

VBSModule3.deobfuscated.vbs

VBAModule4

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule5

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule6

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBAModule7

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

BIN__SRP_4

BIN__SRP_5

BIN__SRP_6

BIN__SRP_7

BIN__SRP_8

BIN__SRP_9

BIN__SRP_a

BIN__SRP_b

BIN__SRP_c

BIN__SRP_d

BIN__SRP_e

BIN__SRP_f

BIN__SRP_10

BIN__SRP_11

BIN__SRP_12

BIN__SRP_13

BIN__SRP_14

BIN__SRP_15

VBAThisWorkbook

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS_VBA_PROJECT

BINcustomXml

XMLitem1.xml

XMLitemProps1.xml

XMLitem2.xml

XMLitem3.xml

BIN_rels

XMLitem1.xml.rels

XMLitem2.xml.rels

XMLitem3.xml.rels

BINdocProps

XMLcore.xml

XMLapp.xml

IMG0x00002D97.svg

IMG0x00002D97.svg-preview.jpg

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

12 / 12

Path oox:xlsm~T1059.005>oox:media>img

Shape oox:xlsm>oox:media>img

technique3 nodes

Path oox:xlsm~T1059.005>bin

Shape oox:xlsm>bin

technique2 nodes

14 malicious · 84 files

XLSdcb4c95311d6c9f5519b1f66a0b5aa26

XML[Content_Types].xml

BIN_rels

BINxl

XMLworkbook.xml

BIN_rels

BINworksheets

BINtheme

XMLstyles.xml

XMLsharedStrings.xml

BINdrawings

BINmedia

VBSvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

VBAModule1

VBS[Stored VBA]

VBA[PCode]

VBAModule2

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBSModule3

VBS[Stored VBA]

VBS[PCode]

VBSModule3.deobfuscated.vbs

VBAModule4

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBAModule5

VBAModule6

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBAModule7

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

BIN__SRP_4

BIN__SRP_5

BIN__SRP_6

BIN__SRP_7

BIN__SRP_8

BIN__SRP_9

BIN__SRP_a

BIN__SRP_b

BIN__SRP_c

BIN__SRP_d

BIN__SRP_e

BIN__SRP_f

BIN__SRP_10

BIN__SRP_11

BIN__SRP_12

BIN__SRP_13

BIN__SRP_14

BIN__SRP_15

VBAThisWorkbook

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS_VBA_PROJECT

BINcustomXml

BINdocProps

IMG0x00002D97.svg

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	Module1	Blacklist VBA VBA Macro
	Module2	Blacklist VBA VBA Macro
	Module4	VBA Macro
	Module5	VBA Macro
	Module6	Blacklist VBA VBA Macro
	Module7	Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	ThisWorkbook	VBA Macro

No malware configuration was found at this point.