Deep Malware Analysis of f40d4e92f318590e25366741a5cbbdb2 | md5: f40d4e92f318590e25366741a5cbbdb2 | Office Document | Blacklist VBA | Scripting.FileSystemObject | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | COM Behavior Trace

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	f40d4e92f318590e25366741a5cbbdb2
Sha1	1a220f40764cc19a4bc5b1da27a0b0fb21f2534f
Sha256	1bb1b27e1695c726c7c1d3d4935f9318afc6f5fd9015d7cf3890f0eb7bf8d47e
Sha384	df29ba730ba2dab100d1046a080aca9b86537cb90466f973d1047f24c206a50d4ce056d4f2578073e99e74022d79979c
Sha512	329275e9c7665b88d7b57f195632ad15037428c63bb086e4d3cb8c309cc046aa6092985eb411f41bc01db73ca68911382d800664eaa0ddeba576f86261a4e1bb
SSDeep	768:LhJjGVkY2TQetH4p4NxllNRsyVs6v6trdxEuUEzI:3RkMBrsyXitTEuUE8
TLSH	EAF2C03DF4247412D692567DB0AD49E6F4100A47C233B09E0909FAACD762ACBA70BD4F

Module1

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 10 STICH kept: 4secondary ignored: 6

bin 1img 1oox:metadata 1oox:style 1oox:theme 1xml 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path oox:docm>oox:vba~T1027~T1059.005

Shape oox:docm>oox:vba

malicious 2 nodes

Path oox:docm>ole:doc~T1059.005

Shape oox:docm>ole:doc

technique2 nodes

Dropped path (COM trace) #1 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #2 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #3 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #4 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #5 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #6 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #7 PATHmalicious

%userphuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

	Module Name0
	Module1	Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.