MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7e622d1dc9b3ace406624b27e06347ea309b1bb2d75cdd30eed0f9de8f521dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Maldoc score: 5

Intelligence 11 IOCs YARA 4 File information Comments

SHA256 hash:	b7e622d1dc9b3ace406624b27e06347ea309b1bb2d75cdd30eed0f9de8f521dc
SHA3-384 hash:	8d6f03d09eb7c382967f6a724995fe2bf7c7b5a358e751ad23153f1962fe8f835dd2a0266fc6666b52dc38ec6b56614d
SHA1 hash:	8d492444d91c04d8212e99a3d18d6938d63e190e
MD5 hash:	6f087e152dbf4b15e70e817b3386e166
humanhash:	bakerloo-mango-undress-monkey
File name:	202507_CTS_Sample_05.xls
Download:	download sample
File size:	1'190'912 bytes
First seen:	2025-07-08 01:24:43 UTC
Last seen:	Never
File type:	xls
MIME type:	application/vnd.ms-excel
ssdeep	6144:cy0REn/T3PFOAqOp0qWkVSbDJDlHG5BM1GEzZ82LFRBFpXxYkFalQ0DYINEm/KhK:pRXkUhmCuxAqlsd
TLSH	T1BA456216B62ACB0BD66653310C9387F83734FD049EB65B077389732E3DB6A549E02798
TrID	46.5% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4) 26.7% (.XLS) Microsoft Excel sheet (32500/1/3) 20.1% (.XLS) Microsoft Excel sheet (alternate) (24500/1/2) 6.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	xls
Reporter	Anonymous
Tags:	xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 5

OLE dump

MalwareBazaar was able to identify 485 sections in this file using oledump:

Section ID	Section size	Section name
1	107 bytes	CompObj
2	612 bytes	DocumentSummaryInformation
3	232 bytes	SummaryInformation
4	577146 bytes	Workbook
5	3693 bytes	_VBA_PROJECT_CUR/PROJECT
6	6347 bytes	_VBA_PROJECT_CUR/PROJECTwm
7	2474 bytes	_VBA_PROJECT_CUR/VBA/Kangatang
8	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_10
9	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_100
10	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_101
11	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_102
12	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_103
13	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_104
14	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_105
15	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_106
16	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_107
17	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_108
18	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_109
19	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_11
20	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_110
21	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_111
22	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_112
23	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_113
24	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_114
25	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_115
26	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_116
27	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_117
28	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_118
29	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_119
30	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_12
31	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_120
32	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_121
33	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_122
34	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_123
35	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_124
36	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_125
37	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_126
38	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_127
39	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_128
40	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_129
41	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_13
42	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_130
43	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_131
44	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_132
45	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_133
46	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_134
47	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_135
48	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_136
49	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_137
50	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_138
51	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_139
52	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_14
53	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_140
54	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_141
55	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_142
56	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_143
57	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_144
58	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_145
59	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_146
60	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_147
61	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_148
62	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_149
63	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_15
64	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_150
65	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_151
66	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_152
67	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_153
68	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_154
69	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_155
70	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_156
71	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_157
72	2486 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_158
73	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_16
74	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_17
75	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_18
76	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_19
77	2476 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_2
78	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_20
79	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_21
80	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_22
81	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_23
82	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_24
83	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_25
84	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_26
85	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_27
86	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_28
87	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_29
88	2484 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_3
89	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_30
90	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_31
91	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_32
92	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_33
93	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_34
94	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_35
95	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_36
96	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_37
97	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_38
98	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_39
99	2484 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_4
100	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_40
101	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_41
102	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_42
103	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_43
104	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_44
105	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_45
106	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_46
107	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_47
108	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_48
109	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_49
110	2484 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_5
111	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_50
112	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_51
113	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_52
114	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_53
115	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_54
116	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_55
117	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_56
118	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_57
119	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_58
120	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_59
121	2484 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_6
122	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_60
123	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_61
124	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_62
125	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_63
126	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_64
127	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_65
128	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_66
129	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_67
130	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_68
131	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_69
132	2484 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_7
133	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_70
134	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_71
135	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_72
136	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_73
137	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_74
138	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_75
139	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_76
140	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_77
141	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_78
142	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_79
143	2484 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_8
144	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_80
145	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_81
146	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_82
147	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_83
148	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_84
149	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_85
150	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_86
151	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_87
152	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_88
153	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_89
154	2484 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_9
155	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_90
156	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_91
157	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_92
158	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_93
159	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_94
160	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_95
161	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_96
162	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_97
163	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_98
164	2485 bytes	_VBA_PROJECT_CUR/VBA/Kangatang_99
165	985 bytes	_VBA_PROJECT_CUR/VBA/ThisWorkbook
166	30091 bytes	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
167	18419 bytes	_VBA_PROJECT_CUR/VBA/__SRP_0
168	1326 bytes	_VBA_PROJECT_CUR/VBA/__SRP_1
169	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_10
170	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_100
171	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_101
172	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_102
173	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_103
174	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_104
175	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_105
176	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_106
177	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_107
178	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_108
179	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_109
180	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_10a
181	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_10b
182	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_10c
183	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_10d
184	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_10e
185	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_10f
186	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_11
187	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_110
188	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_111
189	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_112
190	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_113
191	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_114
192	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_115
193	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_116
194	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_117
195	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_118
196	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_119
197	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_11a
198	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_11b
199	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_11c
200	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_11d
201	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_11e
202	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_11f
203	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_12
204	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_120
205	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_121
206	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_122
207	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_123
208	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_124
209	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_125
210	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_126
211	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_127
212	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_128
213	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_129
214	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_12a
215	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_12b
216	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_12c
217	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_12d
218	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_12e
219	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_12f
220	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_13
221	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_130
222	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_131
223	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_132
224	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_133
225	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_134
226	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_135
227	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_136
228	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_137
229	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_138
230	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_139
231	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_13a
232	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_13b
233	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_13c
234	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_13d
235	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_14
236	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_15
237	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_16
238	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_17
239	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_18
240	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_19
241	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_1a
242	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_1b
243	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_1c
244	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_1d
245	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_1e
246	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_1f
247	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_2
248	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_20
249	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_21
250	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_22
251	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_23
252	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_24
253	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_25
254	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_26
255	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_27
256	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_28
257	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_29
258	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_2a
259	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_2b
260	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_2c
261	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_2d
262	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_2e
263	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_2f
264	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_3
265	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_30
266	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_31
267	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_32
268	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_33
269	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_34
270	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_35
271	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_36
272	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_37
273	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_38
274	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_39
275	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_3a
276	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_3b
277	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_3c
278	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_3d
279	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_3e
280	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_3f
281	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_4
282	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_40
283	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_41
284	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_42
285	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_43
286	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_44
287	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_45
288	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_46
289	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_47
290	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_48
291	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_49
292	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_4a
293	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_4b
294	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_4c
295	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_4d
296	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_4e
297	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_4f
298	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_5
299	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_50
300	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_51
301	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_52
302	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_53
303	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_54
304	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_55
305	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_56
306	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_57
307	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_58
308	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_59
309	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_5a
310	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_5b
311	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_5c
312	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_5d
313	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_5e
314	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_5f
315	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_6
316	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_60
317	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_61
318	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_62
319	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_63
320	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_64
321	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_65
322	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_66
323	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_67
324	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_68
325	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_69
326	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_6a
327	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_6b
328	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_6c
329	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_6d
330	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_6e
331	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_6f
332	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_7
333	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_70
334	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_71
335	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_72
336	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_73
337	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_74
338	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_75
339	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_76
340	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_77
341	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_78
342	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_79
343	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_7a
344	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_7b
345	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_7c
346	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_7d
347	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_7e
348	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_7f
349	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_8
350	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_80
351	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_81
352	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_82
353	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_83
354	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_84
355	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_85
356	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_86
357	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_87
358	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_88
359	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_89
360	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_8a
361	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_8b
362	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_8c
363	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_8d
364	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_8e
365	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_8f
366	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_9
367	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_90
368	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_91
369	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_92
370	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_93
371	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_94
372	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_95
373	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_96
374	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_97
375	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_98
376	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_99
377	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_9a
378	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_9b
379	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_9c
380	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_9d
381	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_9e
382	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_9f
383	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_a
384	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_a0
385	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_a1
386	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_a2
387	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_a3
388	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_a4
389	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_a5
390	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_a6
391	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_a7
392	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_a8
393	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_a9
394	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_aa
395	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_ab
396	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_ac
397	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_ad
398	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_ae
399	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_af
400	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_b
401	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_b0
402	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_b1
403	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_b2
404	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_b3
405	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_b4
406	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_b5
407	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_b6
408	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_b7
409	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_b8
410	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_b9
411	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_ba
412	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_bb
413	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_bc
414	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_bd
415	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_be
416	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_bf
417	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_c
418	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_c0
419	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_c1
420	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_c2
421	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_c3
422	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_c4
423	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_c5
424	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_c6
425	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_c7
426	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_c8
427	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_c9
428	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_ca
429	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_cb
430	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_cc
431	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_cd
432	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_ce
433	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_cf
434	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_d
435	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_d0
436	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_d1
437	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_d2
438	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_d3
439	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_d4
440	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_d5
441	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_d6
442	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_d7
443	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_d8
444	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_d9
445	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_da
446	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_db
447	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_dc
448	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_dd
449	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_de
450	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_df
451	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_e
452	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_e0
453	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_e1
454	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_e2
455	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_e3
456	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_e4
457	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_e5
458	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_e6
459	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_e7
460	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_e8
461	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_e9
462	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_ea
463	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_eb
464	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_ec
465	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_ed
466	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_ee
467	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_ef
468	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_f
469	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_f0
470	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_f1
471	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_f2
472	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_f3
473	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_f4
474	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_f5
475	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_f6
476	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_f7
477	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_f8
478	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_f9
479	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_fa
480	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_fb
481	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_fc
482	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_fd
483	94 bytes	_VBA_PROJECT_CUR/VBA/__SRP_fe
484	140 bytes	_VBA_PROJECT_CUR/VBA/__SRP_ff
485	4597 bytes	_VBA_PROJECT_CUR/VBA/dir

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Auto_Open	Runs when the Excel Workbook is opened
Suspicious	Windows	May enumerate application windows (if combined with Shell.Application object)
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

_b7e622d1dc9b3ace406624b27e06347ea309b1bb2d75cdd30eed0f9de8f521dc.xls

Verdict:

No threats detected

Analysis date:

2025-07-08 01:28:53 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/2a3d4002-f37c-4c56-a46f-119d6f567e7c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/13400/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=686c7383900df8e7f8686b96

Tags:

office macro micro

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Creating a file

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Result

Verdict:

Malicious

File Type:

Legacy Excel File with Macro

Link:

https://app.docguard.net/b7e622d1dc9b3ace406624b27e06347ea309b1bb2d75cdd30eed0f9de8f521dc/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/b7e622d1dc9b3ace406624b27e06347ea309b1bb2d75cdd30eed0f9de8f521dc

Label:

Malicious

Suspicious Score:

10/10

Score Malicious:

Score Benign:

Link:

https://www.malware.ai/gui/files/?id=24d6b758-2c1a-4dd1-8d4f-93eedec60a55

Score:

99%

Verdict:

Malware

File Type:

OFFICE

Link:

https://malprob.io/report/b7e622d1dc9b3ace406624b27e06347ea309b1bb2d75cdd30eed0f9de8f521dc

Verdict:

Malware

YARA:

5 match(es)

Tags:

Blacklist VBA DeObfuscated Obfuscated Office Document T1059.005 VBScript

Link:

https://app.malva.re/file/6f087e152dbf4b15e70e817b3386e166

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b7e622d1dc9b3ace406624b27e06347ea309b1bb2d75cdd30eed0f9de8f521dc/

Threat name:

Script-Macro.Virus.KangKang

Status:

Malicious

First seen:

2025-07-04 10:14:57 UTC

AV detection:

20 of 38 (52.63%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w7tcfuo4tm5m4qdgeszh4brup2rqtmn3fv243uyo5uhz32hvehoa._file

Result

Malware family:

n/a

Score:

8/10

Tags:

macro macro_on_action

Link:

https://tria.ge/reports/250708-bs4ghsyrv8/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Malware Family:

n/a

Verdict:

Malicious

Tags:

Xls.Virus.Valyria-10004391-0

YARA:

n/a

Link:

https://app.threat.zone/submission/49bdbebc-dee5-4b0d-9908-872ff028868b

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.40

Link:

https://yomi.yoroi.company/submissions/b7e622d1dc9b3ace406624b27e06347ea309b1bb2d75cdd30eed0f9de8f521dc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	informational_win_ole_protected Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Identify OLE Project protection within documents.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/13400/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample