Malicious
de646709e3b9100ef82ef0f77da8abd4
MS Excel Document
MD5: de646709e3b9100ef82ef0f77da8abd4
Size: 550.48 KB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan
This sample is a 537.6 KB MS Excel Document classified as malicious by Malva.RE. Static analysis extracted 42 embedded or derived files. It matches 18 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 9257f61caaed4e8962b1e95bf840e68f74260198abfd6f8c23f3bbf943e46f92
- MD5
- de646709e3b9100ef82ef0f77da8abd4
- Verdict
- Malicious
- File type
- MS Excel Document · 537.6 KB
Cite this report: https://app.malva.re/sha256/9257f61caaed4e8962b1e95bf840e68f74260198abfd6f8c23f3bbf943e46f92
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
550.48 KB · 550,481 B
First seen
2026-10-28 15:00 · 6 hours ago
Last seen
2026-10-28 15:00 · 6 hours ago
Last analysis
2026-10-28 15:00 · 6 hours ago
Hashes
MD5
de646709e3b9100ef82ef0f77da8abd4
Sha1
fb3b51ffb30589d40cce51ca7cde3c95d24cb6a4
Sha256
9257f61caaed4e8962b1e95bf840e68f74260198abfd6f8c23f3bbf943e46f92
Sha384
4f5385ba624f16c45bc4f43e0bfaeb4e2b8b5fa7e2f689c863c5ba14346c8fddbf25887d9f7ae69d95fe852b94cef3bc
Sha512
ee5fdc408739764c469033a33a2efb478a5c86901ad029fafa4c749c03cadb0b129a0ccb0127024fa52b74f7395ce61db22d708192cce120c6d32a836ea93634
SSDeep
12288:hc2bSoceqdizOYCEfuN8slzDtFLLbb7Ir6Q12/:C2eDeq0zdfuGsZDf3bUJ2/
TLSH
67C4D0438D149753E46C53F8BE430EAC5E0B2B48E5867AFF15624ECF3E686661C8E42D
8 malicious · 43 files
XLSde646709e3b9100ef82ef0f77da8abd4T1027 · T1059.005
XML[Content_Types].xml
BIN_rels
XML.rels
BINxl
XMLworkbook.xml
BIN_rels
XMLworkbook.xml.rels
BINworksheets
XMLsheet1.xml
BIN_rels
XMLsheet1.xml.rels
BINtheme
XMLtheme1.xml
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
XMLdrawing1.xml
BIN_rels
XMLdrawing1.xml.rels
BINmedia
IMGimage1.jpg
IMGimage1.jpg-preview.png
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
VBS_VBA_PROJECT
VBSSOFISMI_Motore
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBSSOFISMI_EsportaT1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSOFISMI_Esporta.deobfuscated.vbsT1059.005
BINprinterSettings
BINprinterSettings1.bin
XMLcalcChain.xml
BINmetadata
BINdocProps
XMLcore.xml
XMLapp.xml
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
11 / 11
Path
oox:xlsm~T1027~T1059.005>oox:vba~T1027~T1059.005
Shape
oox:xlsm>oox:vba
malicious
2 nodes
Path
oox:xlsm~T1027~T1059.005>oox:vba~T1059.005
Shape
oox:xlsm>oox:vba
malicious
2 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential8 malicious · 43 files
XLSde646709e3b9100ef82ef0f77da8abd4T1027 · T1059.005
XML[Content_Types].xml
BIN_rels
BINxl
XMLworkbook.xml
BIN_rels
BINworksheets
BINtheme
XMLstyles.xml
XMLsharedStrings.xml
BINdrawings
BINmedia
VBSvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
VBS_VBA_PROJECT
VBSSOFISMI_Motore
VBSSOFISMI_EsportaT1027 · T1059.005
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1027 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBSSOFISMI_Esporta.deobfuscated.vbsT1059.005
BINprinterSettings
XMLcalcChain.xml
BINmetadata
BINdocProps
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
de646709e3b9100ef82ef0f77da8abd4 › xl › vbaProject.bin › Root Entry › VBA › SOFISMI_Esporta › [Stored VBA]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account