Malicious MS Excel Document analysis – deccd3fb549e

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

119 malicious · 259 files

XLSMAPA_PROVISAO_v3.2.0.9.xlsm

XML[Content_Types].xml

BIN_rels

BINxl

XMLworkbook.xml

BIN_rels

BINworksheets

BINtheme

XMLstyles.xml

XMLsharedStrings.xml

BINdrawings

BINembeddings

BINmedia

OFFvbaProject.bin

BIN.

BINRoot Entry

BINVBA

BINdir

VBAclsRIBBON

VBAbas_XL_LOG

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBAbas_XL_MAPA

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBA[Partial Diff]

VBAbas_XL_PMBC

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBA[Partial Diff]

VBAbas_XL_PROC

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

VBAbas_XL_CHECK

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBS[Partial Diff]

VBAbas_XL_CLEAN

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBA[Partial Diff]

VBAbas_XL_SPEED

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBA[Partial Diff]

VBAThisWorkbook

BIN_VBA_PROJECT

VBAbas_XL_CONTAB

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBA[Partial Diff]

VBAbas_XL_X_MAPA

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBA[Partial Diff]

VBAbas_XL_X_PMBC

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Partial Diff]

VBAbas__checkSum

VBASTRINGBuilder

VBAbas_XL_SUPPORT

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBS[Partial Diff]

VBAbas____XL_MAIN

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Partial Diff]

HTMbas_XL_DEFAULTS

VBAbas_XL_CALLBACKS

VBAbas____XL_CONSTS

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBA[Full Diff]

VBA[Partial Diff]

VBAbas_XL_AUXILIARES

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBA[Partial Diff]

VBAbas_XL_VALIDATION

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBA[Partial Diff]

VBAbas____XL_READINI

VBAbas____XL_WPSHELL

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBA[Partial Diff]

VBAbas_XL_MAPA_ANTERIOR

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBA[Partial Diff]

VBAbas____XL_ERROR_HANDLING

VBS[Stored VBA]

VBA[PCode]

VBS[Decompiled VBA]

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBS[Partial Diff]

BINPROJECT

BINPROJECTwm

XMLconnections.xml

BINprinterSettings

XMLcomments1.xml

XMLcalcChain.xml

XMLxmlMaps.xml

BINtables

BINdocProps

BINcustomUI

	Module Name0
	clsRIBBON	VBA Macro
	bas_XL_LOG	Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	bas_XL_MAPA	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	bas_XL_PMBC	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas_XL_PROC	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas_XL_CHECK	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas_XL_CLEAN	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas_XL_SPEED	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	ThisWorkbook	VBA Macro
	bas_XL_CONTAB	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas_XL_X_MAPA	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas_XL_X_PMBC	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas__checkSum	VBA Macro
	STRINGBuilder	VBA Macro
	bas_XL_SUPPORT	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas____XL_MAIN	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas_XL_CALLBACKS	Blacklist VBA VBA Macro
	bas____XL_CONSTS	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas_XL_AUXILIARES	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas_XL_VALIDATION	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas____XL_READINI	VBA Macro
	bas____XL_WPSHELL	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas_XL_MAPA_ANTERIOR	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	bas____XL_ERROR_HANDLING	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential