Malicious
MS Word Document
MD5: eb9715a5304e3dd9c2756ac51ab3234e
Size: 543.55 KB
application/msword
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
543.55 KB · 543,551 B
First seen
2025-07-06 14:30 · one year ago
Last seen
2025-07-06 14:30 · one year ago
Last analysis
2025-07-06 14:40 · one year ago
Hashes
MD5
eb9715a5304e3dd9c2756ac51ab3234e
Sha1
8aaf84974c428c49dde6bf797cda387a3a8febb5
Sha256
4a16071cd4a31e06e7a47f7f449d846991f6dbf476861c4b4ffa806705efdd4e
Sha384
c97c6e71a7d7ed5cc44c321010d9def1b1e3f1ec334da17df0ab9731cb0901888e6937a13822391e84beed85990cf4e9
Sha512
862b45b7759ae3b104b92628ee43e4ca48499efd865c5e6cb7e968f1345d702ef2f23aaa79e7688572db2a2602cf9cbf15e2bd5589986c7d482b92187f8ca8d7
SSDeep
12288:gQZQHyBGWyy4FvGXJrJ0ir3ph8DnD4PXszO157wCtbtW3dyA:jaHQO0XJrmir3pKLMPXszCtbgV
TLSH
38C4F1C1F4E62D76C232157A7FEBE460FF60CA7362847516B30E2A681FB36676517084
340 malicious · 635 files
DOCeb9715a5304e3dd9c2756ac51ab3234eT1221 · T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
XML.rels
BINword
XMLdocument.xml
BIN_rels
OFFdocument.xml.relsT1221
XMLvbaProject.bin.rels
XMLendnotes.xml
XMLheader1.xml
XMLheader2.xml
XMLfooter1.xml
XMLfooter2.xml
XMLheader3.xml
XMLfooter3.xml
XMLfootnotes.xml
OFFvbaProject.binATT&CK T1564.007
BIN.
BINRoot Entry
BINVBA
BINdir
VBAחלוןATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAקודשATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAמנצפךATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAסימוןATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAשונותATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAהחלפותATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAהפנייהATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAכותרותATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAinstall
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAModule1
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
VBAטקסט_רץATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAלך_לקטעATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAסוגרייםATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBASearcher
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAstyleref
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAכותרת_צד
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAFootnotesATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAUserForm1
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAרצף_הערותATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAlinetoline
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAPleaseWait
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAהערות_ברצףATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAכותרות_צד2ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAמעצב_טוריםATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAFindReplace
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAopen_link_1
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAopen_link_2
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAParenthesis
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAמילה_ראשונהATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAשורה_אחרונהATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAmodPopupMenu
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAUpdate_CrossATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
BIN_VBA_PROJECT
VBAמאקרו_לטאביםATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAתיקון_שגיאותATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAMyParenthesis
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBARibbonControlATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBATransfomToSeq
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAאינדקס_והערותATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAכותרת_מתעדכנתATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAמספור_אוטומטיATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAסוגריים_שגיאה
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAפסקאות_כפולותATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBASearchManyFiles
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAexport_CR_to_tag
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
VBAהקטן_הגדל_רווחים
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAמספור_עברי_הערותATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAנקודה_בסוף_פיסקהATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAתיקון_שגיאות_שפה
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAהחלפה_באבני_בניין
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAהחלפת_כמה_מילים_1ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAהערות_יותר_משצב_2ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAיישר_כל_המסמך_חדשATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAמציג_קיצורי_מקשיםATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBS[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAתיקון_שגיאות_מקורATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBAFirstWordStyleHelpATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAיישור_טור_בעמוד_זהATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAעיצוב_תורני_גרסה_3ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAתיקון_שגיאות_מנצפךATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAהמרת_מספרים_לאותיותATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAחיפוש_והחלפה_מרובים
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAחיפוש_והחלפה_משודרגATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAמעבר_עמוד_לפי_סגנוןATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAעיצוב_פיסקה_החל_הכלATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAחיפוש_והחלפה_פרטנייםATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAעיצוב_כותרות_צד_הוראות
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAחילוץ_טקסטים_פירוק_מסמךATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAיישר_ממיקום_זה_עד_סוף_המסמךATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAתיקון_שגיאות_רווחים_וסימניםATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAישור_טורים_מאמר_זה_מכותרתלכותרתATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
BINהפנייה
BINf
BINo
BINi101
BINf
BINo
BINCompObj
BINi115
BINf
BINo
BINCompObj
BINVBFrame
BINPROJECT
BINלך_לקטע
BINf
BINo
BINVBFrame
BINSearcher
BINf
BINo
BINVBFrame
BINstyleref
BINf
BINo
BINi14
BINf
BINo
BINi16
BINf
BINo
BINi18
BINf
BINo
BINVBFrame
BINכותרת_צד
BINf
BINo
BINVBFrame
BINPROJECTlk
BINPROJECTwm
BINUserForm1
BINf
BINo
BINi03
BINf
BINo
BINVBFrame
BINPleaseWait
BINf
BINo
BINVBFrame
BINParenthesis
BINf
BINo
BINi04
BINf
BINo
BINi11
BINf
BINo
BINi17
BINf
BINo
BINi29
BINf
BINo
BINVBFrame
BINUpdate_Cross
BINf
BINo
BINi36
BINf
BINo
BINVBFrame
BINמאקרו_לטאבים
BINf
BINo
BINi21
BINf
BINo
BINi55
BINf
BINo
BINi77
BINf
BINo
BINi79
BINf
BINo
BINi65
BINf
BINo
BINVBFrame
BINMyParenthesis
BINf
BINo
BINi11
BINf
BINo
BINi17
BINf
BINo
BINi44
BINf
BINo
BINi66
BINf
BINo
BINi70
BINf
BINo
BINVBFrame
BINTransfomToSeq
BINf
BINi19
BINf
BINo
BINi22
BINf
BINo
BINi24
BINf
BINo
BINVBFrame
BINSearchManyFiles
BINf
BINo
BINVBFrame
BINexport_CR_to_tag
BINf
BINo
BINVBFrame
BINהקטן_הגדל_רווחים
BINf
BINo
BINi73
BINf
BINo
BINi122
BINf
BINo
BINi130
BINf
BINo
BINi172
BINf
BINo
BINi203
BINf
BINo
BINVBFrame
BINהחלפה_באבני_בניין
BINf
BINo
BINVBFrame
BINFirstWordStyleHelp
BINf
BINo
BINVBFrame
BINחיפוש_והחלפה_מרובים
BINf
BINo
BINVBFrame
BINחיפוש_והחלפה_משודרג
BINf
BINo
BINVBFrame
BINעיצוב_כותרות_צד_הוראות
BINf
BINo
BINVBFrame
BINtheme
XMLtheme1.xml
XMLvbaData.xml
XMLsettings.xml
BINglossary
XMLdocument.xml
XMLsettings.xml
BIN_rels
XMLdocument.xml.rels
XMLstyles.xml
XMLwebSettings.xml
XMLfontTable.xml
XMLstyles.xml
XMLwebSettings.xml
XMLnumbering.xml
XMLfontTable.xml
BINcustomXml
XMLitem1.xml
XMLitemProps1.xml
BIN_rels
XMLitem1.xml.rels
BINdocProps
XMLcore.xml
XMLapp.xml
XMLcustom.xml
BINcustomUI
BINimages
IMGwindow.png
IMGwindow.png-preview.png
IMGfirstworddelete.png
IMGfirstworddelete.png-preview.png
IMGcenterlastlinedelete.png
IMGcenterlastlinedelete.png-preview.png
IMGwindowdelete.png
IMGwindowdelete.png-preview.png
IMGinstall.png
IMGinstall.png-preview.png
IMGall.png
IMGall.png-preview.png
IMGalldelete.png
IMGalldelete.png-preview.png
IMGcenterlastline.png
IMGcenterlastline.png-preview.png
IMGfirstwordaddanddelete.png
IMGfirstwordaddanddelete.png-preview.png
IMGfirstword.png
IMGfirstword.png-preview.png
XMLcustomUI14.xml
BIN_rels
XMLcustomUI14.xml.rels
| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | documhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious Document RelationShip
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential340 malicious · 635 files
DOCeb9715a5304e3dd9c2756ac51ab3234eT1221 · T1059.005 · ATT&CK T1564.007
XML[Content_Types].xml
BIN_rels
BINword
XMLdocument.xml
BIN_rels
OFFdocument.xml.relsT1221
XMLvbaProject.bin.rels
XMLendnotes.xml
XMLheader1.xml
XMLheader2.xml
XMLfooter1.xml
XMLfooter2.xml
XMLheader3.xml
XMLfooter3.xml
XMLfootnotes.xml
OFFvbaProject.binATT&CK T1564.007
BIN.
BINRoot Entry
BINVBA
BINdir
VBAחלוןATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAקודשATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAמנצפךATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAסימוןATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAשונותATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAהחלפותATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAהפנייהATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAכותרותATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAinstall
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAModule1
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
VBAטקסט_רץATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAלך_לקטעATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAסוגרייםATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBASearcher
VBAstyleref
VBAכותרת_צד
VBAFootnotesATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAUserForm1
VBAרצף_הערותATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAlinetoline
VBAPleaseWait
VBAהערות_ברצףATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAכותרות_צד2ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAמעצב_טוריםATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAFindReplace
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]
VBAopen_link_1
VBAopen_link_2
VBAParenthesis
VBAמילה_ראשונהATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAשורה_אחרונהATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAmodPopupMenu
VBAUpdate_CrossATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
BIN_VBA_PROJECT
VBAמאקרו_לטאביםATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAתיקון_שגיאותATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAMyParenthesis
VBARibbonControlATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBATransfomToSeq
VBS[Stored VBA]T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBAאינדקס_והערותATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAכותרת_מתעדכנתATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAמספור_אוטומטיATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAסוגריים_שגיאה
VBAפסקאות_כפולותATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBASearchManyFiles
VBAexport_CR_to_tag
VBAהקטן_הגדל_רווחים
VBAמספור_עברי_הערותATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAנקודה_בסוף_פיסקהATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAתיקון_שגיאות_שפה
VBAהחלפה_באבני_בניין
VBAהחלפת_כמה_מילים_1ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAהערות_יותר_משצב_2ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAיישר_כל_המסמך_חדשATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAמציג_קיצורי_מקשיםATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBS[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAתיקון_שגיאות_מקורATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBAFirstWordStyleHelpATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAיישור_טור_בעמוד_זהATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAעיצוב_תורני_גרסה_3ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAתיקון_שגיאות_מנצפךATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAהמרת_מספרים_לאותיותATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAחיפוש_והחלפה_מרובים
VBAחיפוש_והחלפה_משודרגATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAמעבר_עמוד_לפי_סגנוןATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAעיצוב_פיסקה_החל_הכלATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAחיפוש_והחלפה_פרטנייםATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBAעיצוב_כותרות_צד_הוראות
VBAחילוץ_טקסטים_פירוק_מסמךATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAיישר_ממיקום_זה_עד_סוף_המסמךATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAתיקון_שגיאות_רווחים_וסימניםATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAישור_טורים_מאמר_זה_מכותרתלכותרתATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
BINהפנייה
BINPROJECT
BINלך_לקטע
BINSearcher
BINstyleref
BINכותרת_צד
BINPROJECTlk
BINPROJECTwm
BINUserForm1
BINPleaseWait
BINParenthesis
BINUpdate_Cross
BINמאקרו_לטאבים
BINMyParenthesis
BINTransfomToSeq
BINSearchManyFiles
BINexport_CR_to_tag
BINהקטן_הגדל_רווחים
BINהחלפה_באבני_בניין
BINFirstWordStyleHelp
BINחיפוש_והחלפה_מרובים
BINחיפוש_והחלפה_משודרג
BINעיצוב_כותרות_צד_הוראות
BINtheme
XMLvbaData.xml
XMLsettings.xml
BINglossary
XMLstyles.xml
XMLwebSettings.xml
XMLnumbering.xml
XMLfontTable.xml
BINcustomXml
BINdocProps
BINcustomUI
| Config. Field | Value |
|---|---|
| Target | https:huhuhuhuhuhuhuhuhuhuhu |
| Path | documhuhuhuhuhuhuhu |
| XPath | /Relathuhuhuhuhuhuhuhuhuhuhu |
| Outer XML | <Relathuhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialRemote Template - Highly Suspicious Document RelationShip
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
eb9715a5304e3dd9c2756ac51ab3234e › word › _rels › document.xml.rels
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account