Malicious
Malicious

e87eb0b055f81acd5167b817b6c4bd96

MS Excel Document
MD5: e87eb0b055f81acd5167b817b6c4bd96
Size: 2.22 MB
application/vnd.ms-excel
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e87eb0b055f81acd5167b817b6c4bd96
Sha1 19b550354b493af8be565a3c30b927bb6588b6ea
Sha256 42255ff1914882e20ddb9116b521287dccd2bee944e056bc8f1bd1c2970299a6
Sha384 1e16b01cb5d9323e5c5611826d173707f92282561b1715fba6390ba340f0a236900140183c5739d85724d2546fd81a0a
Sha512 254942220e689417fb2a7c40524e91ce658bf8bd932b523489b318cb1ed1b87f50769655544bc5478f1f26aad4c4b544c415fdc31c3d52b537efd929e4ae4633
SSDeep 49152:xPyqcb1KIss6Ri1CB2Cw8oYRq75Npv8SNlbDPLP7mPFFaoz9GW3r45:xaqcb1KIT6nB2Cw8675XkSNdzfmjdRGN
TLSH 34A533607C760FD5C12D00FB82417269696A05FAF72097FF897B93E89CD50A76EC06E8
[Content_Types].xml
_rels
.rels
xl
workbook.xml
_rels
workbook.xml.rels
worksheets
sheet1.xml
sheet2.xml
theme
theme1.xml
styles.xml
sharedStrings.xml
vbaProject.bin
Root Entry
PROJECT
PROJECTwm
docProps
core.xml
app.xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 8 STICH kept: 3secondary ignored: 5
bin 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path oox:xlsm>oox:vba~T1059.005
Shape oox:xlsm>oox:vba
technique2 nodes
Path oox:xlsm>ole:doc
Shape oox:xlsm>ole:doc
2 nodes
[Content_Types].xml
_rels
.rels
xl
workbook.xml
_rels
workbook.xml.rels
worksheets
sheet1.xml
sheet2.xml
theme
theme1.xml
styles.xml
sharedStrings.xml
vbaProject.bin
Root Entry
PROJECT
PROJECTwm
docProps
core.xml
app.xml

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
ThisWorkbook
Blacklist VBA
VBA Macro
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙