Malicious
MS Excel Document
MD5: dcb4c95311d6c9f5519b1f66a0b5aa26
Size: 2.34 MB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
2.34 MB · 2,337,149 B
Hashes
MD5
dcb4c95311d6c9f5519b1f66a0b5aa26
Sha1
094b4e277e07d60c6f2b31b629a503e55d3268a0
Sha256
9d66bfddb6058cd175177ae545831d76c64b2a9a41585d81cb83a54d0eaf210b
Sha384
8a3c0bd0c7d0a1ee8e30928d3705e1053597f863aff9dd71dd67561a1720765f526f7a3ad1a623615315374d0c88f18b
Sha512
42f0ab6f1091f507f59ffb602c65b418529d3eee319b05c13bb735a9fea6c42b30c54d07d223306ac2e6bb935dfb3e4ba0781b3cd0931981c0d59b44cc876036
SSDeep
49152:Mpsc2PGcXoKIJTQHC1O1WXELed/oh+A1hDIvlppikESOe8cR:MpscN1BUC1O1W0TspvYSOZi
TLSH
1CB53322425B39F7D67E887B641CF8E52A0877C41089AC7A21D25C0B1775BEB9049FFE
14 malicious · 84 files
XLSdcb4c95311d6c9f5519b1f66a0b5aa26T1027 · T1059.005
XML[Content_Types].xml
BIN_rels
BINxl
XMLworkbook.xml
BIN_rels
BINworksheets
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
BINmedia
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBAModule1
VBS[Stored VBA]T1059.005
VBA[PCode]
VBAModule2
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBSModule3T1027 · T1059.005
VBS[Stored VBA]T1059.005
VBS[PCode]
VBSModule3.deobfuscated.vbsT1059.005
VBAModule4
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAModule5
VBAModule6
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAModule7
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECT
BINcustomXml
BINdocProps
IMG0x00002D97.svg
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
12 / 12
Path
oox:xlsm~T1059.005>oox:media>img
Shape
oox:xlsm>oox:media>img
technique3 nodes
Path
oox:xlsm~T1059.005>bin
Shape
oox:xlsm>bin
technique2 nodes