Deep Malware Analysis of e40bd8f8f47e0ae7d7416aadd55b5451 | md5: e40bd8f8f47e0ae7d7416aadd55b5451 | Office Document | VBA Stomping | ATT&CK T1564.007 | Malicious | Malicious Document | Blacklist VBA | T1059.005 | DeObfuscated | VBScript | Obfuscated | T1027 | SOS: 0.48 | SOS: 0.22 | SOS: 0.23 | COM Behavior Trace | SOS: 0.29 | SOS: 0.32 | SOS: 0.40 | SOS: 0.35 | SOS: 0.28

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	e40bd8f8f47e0ae7d7416aadd55b5451
Sha1	c47f969111ca36b49f7fc7449cf9c037440c15bc
Sha256	e20413254a149c372a43765a020b1c9abc9ba211cfc8c0fe4342c0997ee4745c
Sha384	78e0341004b54a14c3d274606376dc9f831648ac874a9a20a852fa79d7faf9e0796e60bc00addf76fafe03cc5b7eddff
Sha512	2419e1d8d10bda65b573ce571534dc6eec279668b29b96d9742c5d478b3eefc99ccf4849a96e4405c0dbc6217f8242388574d480d181c57e66bcaa8cee9351b2
SSDeep	6144:xk3hbdlylKsgqopeJBWhZFVE+W2NdMPyzqJSaVZjEir+Pmro8YbLoLohHeKbu6Y+:ZyWIaf4Q+/8FLosqa84JIj+aP9JH
TLSH	ACE46C09B155C43BC99946314C96D6EABE70BC035F4EB3CB36487BAE3E7A7209B06750

e40bd8f8f47e0ae7d7416aadd55b5451

Malicious

Root Entry

Malicious

CompObj

Workbook

SummaryInformation

DocumentSummaryInformation

_VBA_PROJECT_CUR

Malicious

PROJECT

PROJECTwm

VBA

Malicious

dir

Module1

Malicious

Module1

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module2

Malicious

Module2

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module3

Module3

[Stored VBA]

Malicious

[PCode]

Module4

Malicious

Module4

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module5

Module5

[Stored VBA]

Malicious

[PCode]

Module6

Malicious

Module6

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module7

Malicious

Module7

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module8

Module8

[Stored VBA]

Malicious

[PCode]

Module9

Malicious

Module9

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

__SRP_0

__SRP_1

__SRP_2

__SRP_3

__SRP_4

__SRP_5

__SRP_6

__SRP_7

__SRP_8

__SRP_9

__SRP_c

__SRP_d

__SRP_e

__SRP_f

Module10

Malicious

Module10

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module11

Malicious

Module11

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module12

Malicious

Module12

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

__SRP_10

__SRP_11

__SRP_12

__SRP_13

__SRP_14

__SRP_15

__SRP_16

__SRP_17

ThisWorkbook

ThisWorkbook

[Stored VBA]

Malicious

[PCode]

[Decompiled VBA]

Malicious

_VBA_PROJECT

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

7 / 7

Path ole:doc~T1027~T1059.005~T1564.007>bin

Shape ole:doc>bin

malicious 2 nodes

Path ole:doc~T1027~T1059.005~T1564.007>ole:vba

Shape ole:doc>ole:vba

malicious 2 nodes

Trace COM ordonnée UNKNWOWNmalicious

line 2huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 4huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 6huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

e40bd8f8f47e0ae7d7416aadd55b5451

Malicious

Root Entry

Malicious

CompObj

Workbook

SummaryInformation

DocumentSummaryInformation

_VBA_PROJECT_CUR

Malicious

PROJECT

PROJECTwm

VBA

Malicious

dir

Module1

Malicious

Module1

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module2

Malicious

Module2

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module3

Module3

[Stored VBA]

Malicious

[PCode]

Module4

Malicious

Module4

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module5

Module5

[Stored VBA]

Malicious

[PCode]

Module6

Malicious

Module6

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module7

Malicious

Module7

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module8

Module8

[Stored VBA]

Malicious

[PCode]

Module9

Malicious

Module9

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

__SRP_0

__SRP_1

__SRP_2

__SRP_3

__SRP_4

__SRP_5

__SRP_6

__SRP_7

__SRP_8

__SRP_9

__SRP_c

__SRP_d

__SRP_e

__SRP_f

Module10

Malicious

Module10

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module11

Malicious

Module11

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

Module12

Malicious

Module12

Malicious

[Stored VBA]

Malicious

[PCode]

Malicious

[Decompiled VBA]

Malicious

[Full Diff]

Malicious

[Partial Diff]

Malicious

__SRP_10

__SRP_11

__SRP_12

__SRP_13

__SRP_14

__SRP_15

__SRP_16

__SRP_17

ThisWorkbook

ThisWorkbook

[Stored VBA]

Malicious

[PCode]

[Decompiled VBA]

Malicious

_VBA_PROJECT

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	Module1	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Module2	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.
	Module3	VBA Macro
	Module4	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module5	VBA Macro
	Module6	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module7	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module8	Blacklist VBA VBA Macro
	Module9	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module10	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module11	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	Module12	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
vbaDNA free preview is limited to 3 modules. Unlock the full module analysis (decompiled P-Code, stomping diffs). Unlock with Essential
	ThisWorkbook	VBA Macro

No malware configuration was found at this point.

Trace COM ordonnée UNKNWOWNmalicious

line 2huhuhuhuhuhuhuhuhuhuhu

e40bd8f8f47e0ae7d7416aadd55b5451 › Root Entry › _VBA_PROJECT_CUR › VBA › Module7 › [Stored VBA]

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

e40bd8f8f47e0ae7d7416aadd55b5451 › Root Entry › _VBA_PROJECT_CUR › VBA › Module7 › [Full Diff]

Trace COM ordonnée UNKNWOWNmalicious

line 4huhuhuhuhuhuhuhuhuhuhu

e40bd8f8f47e0ae7d7416aadd55b5451 › Root Entry › _VBA_PROJECT_CUR › VBA › Module6 › [Full Diff]

Trace COM ordonnée UNKNWOWNmalicious

line 6huhuhuhuhuhuhuhuhuhuhu

e40bd8f8f47e0ae7d7416aadd55b5451 › Root Entry › _VBA_PROJECT_CUR › VBA › Module2 › [Decompiled VBA]

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.

You need a premium account to access this feature.

You must be signed in to post a comment.