Malicious MS Word Document analysis – 59657f453701

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Microsoft Office Document

Size

85.51 KB · 85,507 B

First seen

2024-12-19 19:38 · one year ago

Last seen

2024-12-19 19:38 · one year ago

Last analysis

2024-12-19 19:39 · one year ago

Hashes

MD5 e9e6f32925c8fb28a3834e4a4575d566 Sha1 7b220d821d5cc32cf8a9fa105985b1bb550029b5 Sha256 59657f4537018aa3621450282e9a973895e33e6f236f4f644769a505c498c004 Sha384 0b9e9255c49667026cd297666ab83b1efcac20ee42301e1b333c853bc017d4853df32fb680e8c51f9787c82a00c8198b Sha512 acbbb209b5b94781dd9600a7c20476d0b39d5bbb9fb1806aee68f2264d8725f03fc9427683db88862d3d7d81bd53fa47f88f4be579b66a966fcc0ea6f618db20 SSDeep 1536:+o+WqQuctgdRm+yapjClC3H5wCVG3OrH65/7VUs0ngCjuYbgGvtioOXClI:R+X8YfHtC2HV4O7eTv0ngCjuBGvtFOC2 TLSH 8E83026ED7FE4921D147F3BC301A2C49E21E6B8FF0EDB19639D1A3CC87268A18752546

11 malicious · 37 files

DOC59657f4537018aa3621450282e9a973895e33e6f236f4f644769a505c498c004.docm

XML[Content_Types].xml

BIN_rels

BINword

BIN_rels

XMLdocument.xml

BINtheme

XMLsettings.xml

XMLstylesWithEffects.xml

XMLstyles.xml

XMLfontTable.xml

XMLwebSettings.xml

XMLvbaData.xml

OFFvbaProject.bin

BIN.

BINVBA

BINdir

VBANewMacros

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

VBS[Full Diff]

VBS[Full Diff].deobfuscated.vbs

VBS[Partial Diff]

BIN_VBA_PROJECT

BINPROJECT

BINPROJECTwm

BINdocProps

BINcustomXml

Config. Field	Value
URL #1	http:/huhuhuhuhuhuhu
URL #2	http:huhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

	Module Name0
	NewMacros	VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.