Malicious
MS Office Document
MD5: f8de24d35a004e158a594303c04d4d85
Size: 3.6 MB
application/vnd.ms-office
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Microsoft Office Document
Size
3.6 MB · 3,595,776 B
First seen
2026-09-04 12:30 · one month ago
Last seen
2026-09-04 12:30 · one month ago
Last analysis
2026-09-04 12:30 · one month ago
Hashes
MD5
f8de24d35a004e158a594303c04d4d85
Sha1
a7ff51a83cc52836a9c4e1232aff7fbdb3b4d651
Sha256
5865cccca8ec217c98d0eca0b312c53d8b0c7e33318b847d369a03a385324e64
Sha384
3204e962eea459bbe97fd7f37c61206e70af2c99e20c22f76dd8ee2bcdb61d51cd7efe574aed62ce19dd35d41e30ccb2
Sha512
1ce5543a3eaad7586474f0218d5b6f3cc85ca2ec420e737d7b79e6e67bab18df1b6ca98c905fa74313a7421aa180484feb99791691abaa508f1627d9b56cc2cc
SSDeep
24576:cKl+JHcCwAs11L+qjxm7UITiwgJ5B77WMsFhSNLJ7Uq9B5Y7:AcTjsiwbgBy7
TLSH
9AF56663E62E0B6BC4398B78428F5B906318DC1B36915B471B5D3E68FDAECD3E931508
48 malicious · 129 files
OFFf8de24d35a004e158a594303c04d4d85T1027 · T1059 · T1059.005
BINRoot Entry
BINCompObj
BINWorkbook
BINSummaryInformation
BINDocumentSummaryInformation
BIN_VBA_PROJECT_CUR
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
VBASheet1
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBAModule1ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAModule2
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAModule3
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBAModule4
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBAModule5
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBAModule6
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBAModule7
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBAModule9
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
BIN__SRP_4
BIN__SRP_5
BIN__SRP_6
BIN__SRP_7
BIN__SRP_8
BIN__SRP_9
BIN__SRP_a
BIN__SRP_b
BIN__SRP_c
BIN__SRP_d
BIN__SRP_e
BIN__SRP_f
VBAModule10
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]
VBAModule11
VBS[Stored VBA]T1027 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBAModule12ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBA[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBSModule13ATT&CK T1564.007
VBS[Stored VBA]ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]ATT&CK T1564.007
VBS[Full Diff]ATT&CK T1564.007
VBA[Partial Diff]ATT&CK T1564.007
VBAModule14
VBSModule15ATT&CK T1564.007
VBS[Stored VBA]T1027 · T1059 · T1059.005
VBS[Stored VBA].deobfuscated.vbsT1059.005
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1027 · T1059 · T1059.005
VBS[Decompiled VBA].deobfuscated.vbsT1059.005
VBS[Full Diff]T1027 · T1059 · T1059.005
VBS[Full Diff].deobfuscated.vbsT1059.005
VBA[Partial Diff]ATT&CK T1564.007
VBSModule16T1027 · T1059.005 · ATT&CK T1564.007
VBS[Stored VBA]T1059.005 · ATT&CK T1564.007
VBA[PCode]ATT&CK T1564.007
VBS[Decompiled VBA]T1059.005 · ATT&CK T1564.007
VBS[Full Diff]T1059.005 · ATT&CK T1564.007
VBSModule16.deobfuscated.vbsT1059.005
BIN__SRP_10
BIN__SRP_11
BIN__SRP_12
BIN__SRP_13
BIN__SRP_14
BIN__SRP_15
BIN__SRP_16
BIN__SRP_17
BIN__SRP_18
BIN__SRP_19
BIN__SRP_1a
BIN__SRP_1b
BIN__SRP_1c
BIN__SRP_1d
BIN__SRP_1e
BIN__SRP_1f
BIN__SRP_20
BIN__SRP_21
BIN__SRP_22
BIN__SRP_23
BIN__SRP_24
BIN__SRP_25
BIN__SRP_26
BIN__SRP_27
BIN__SRP_28
BIN__SRP_29
BIN__SRP_2a
BIN__SRP_2b
VBAThisWorkbook
VBS[Stored VBA]T1059.005
VBA[PCode]
VBS[Decompiled VBA]T1059.005
VBS_VBA_PROJECTT1027 · T1059.005
VBS_VBA_PROJECT.deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
10 / 10
Path
ole:doc~T1027~T1059~T1059.005~T1564.007>bin
Shape
ole:doc>bin
malicious
2 nodes
Path
ole:doc~T1027~T1059~T1059.005~T1564.007>ole:vba~T1059.005
Shape
ole:doc>ole:vba
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 4huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #1
UNKNWOWNmalicious
https:huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 7huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential