MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5c9b643b5c7e4f1ca90f8f6ccaeb24f681441ce9fecbe5154416ad661143b2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Maldoc score: 23

Intelligence 11 IOCs YARA 7 File information Comments

SHA256 hash:	d5c9b643b5c7e4f1ca90f8f6ccaeb24f681441ce9fecbe5154416ad661143b2e
SHA3-384 hash:	5f36d172155d1092158a20c9ec57e86a0910d4ed71bb8e78c954911b61e8e62f0e76371f0a0a4eab38d85f2b2b4e4dba
SHA1 hash:	924f979eab2ae7329fe03edcb5bf7914919ade7c
MD5 hash:	986f66510d4e0701f47d0c3b35d705e2
humanhash:	missouri-snake-kansas-sixteen
File name:	presupuestos_inhabi.xlsm
Download:	download sample
File size:	1'304'461 bytes
First seen:	2026-06-24 08:11:18 UTC
Last seen:	Never
File type:	xlsm
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	24576:NLdoU9BiwIiaa9dAYWeSDz8aCea9YWDru8eRv0o123bT0o1K5:UqUziH9dAYWTDXCT9ZriR8pEoE5
TLSH	T13455012DDA02AA1CD22A943CC30F74D1D988A0637201E91F399DFD191F872E7975EE9D
TrID	40.3% (.XLAM) Excel Macro-enabled Open XML add-in (83500/1/13) 27.7% (.XLSM) Excel Microsoft Office Open XML Format document (with Macro) (57500/1/12) 16.4% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7) 8.4% (.ZIP) Open Packaging Conventions container (17500/1/4) 5.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
Magika	xlsx
Reporter	abuse_ch
Tags:	xlsm

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 23

File Format is MS Excel 2007+

Container Format is OpenXML

Office document contains VBA Macros

Embedded Images

MalwareBazaar found the following images embedded in this file:

MD5 hash	dc.creator	# of relations
4ad6fedb22369f395cd6a8610506741c	marro	None
8cff9f5bcb69770de027a4d2066ac2c3	marro	None
44ad10b17a7bbd5fd53b5ea74d9a5a0d	marro	None
d472d91f68338bc935f1efcbdf31d52c	marro	None

OLE dump

MalwareBazaar was able to identify 143 sections in this file using oledump:

Section ID	Section size	Section name
A1	4965 bytes	PROJECT
A2	2099 bytes	PROJECTwm
A3	97 bytes	UserForm1/CompObj
A4	304 bytes	UserForm1/VBFrame
A5	867 bytes	UserForm1/f
A6	112 bytes	UserForm1/i14/CompObj
A7	157 bytes	UserForm1/i14/f
A8	120 bytes	UserForm1/i14/o
A9	896 bytes	UserForm1/o
A10	1050 bytes	VBA/Hoja1
A11	1051 bytes	VBA/Hoja10
A12	1051 bytes	VBA/Hoja11
A13	1051 bytes	VBA/Hoja12
A14	1051 bytes	VBA/Hoja13
A15	1051 bytes	VBA/Hoja14
A16	1051 bytes	VBA/Hoja15
A17	1051 bytes	VBA/Hoja16
A18	1051 bytes	VBA/Hoja17
A19	1051 bytes	VBA/Hoja18
A20	1232 bytes	VBA/Hoja19
A21	1231 bytes	VBA/Hoja2
A22	1051 bytes	VBA/Hoja20
A23	1051 bytes	VBA/Hoja21
A24	1051 bytes	VBA/Hoja22
A25	1051 bytes	VBA/Hoja23
A26	1051 bytes	VBA/Hoja24
A27	1051 bytes	VBA/Hoja25
A28	1240 bytes	VBA/Hoja26
A29	1051 bytes	VBA/Hoja27
A30	1051 bytes	VBA/Hoja28
A31	1051 bytes	VBA/Hoja29
A32	5953 bytes	VBA/Hoja3
A33	1051 bytes	VBA/Hoja30
A34	1051 bytes	VBA/Hoja31
A35	1051 bytes	VBA/Hoja32
A36	1051 bytes	VBA/Hoja33
A37	1187 bytes	VBA/Hoja34
A38	1051 bytes	VBA/Hoja35
A39	1187 bytes	VBA/Hoja36
A40	1051 bytes	VBA/Hoja37
A41	1051 bytes	VBA/Hoja38
A42	1051 bytes	VBA/Hoja39
A43	1051 bytes	VBA/Hoja40
A44	1051 bytes	VBA/Hoja41
A45	1051 bytes	VBA/Hoja42
A46	1051 bytes	VBA/Hoja43
A47	1051 bytes	VBA/Hoja44
A48	1051 bytes	VBA/Hoja45
A49	1051 bytes	VBA/Hoja46
A50	1051 bytes	VBA/Hoja47
A51	1051 bytes	VBA/Hoja48
A52	1051 bytes	VBA/Hoja49
A53	1239 bytes	VBA/Hoja5
A54	1051 bytes	VBA/Hoja50
A55	1051 bytes	VBA/Hoja51
A56	1051 bytes	VBA/Hoja52
A57	1051 bytes	VBA/Hoja53
A58	1051 bytes	VBA/Hoja54
A59	1051 bytes	VBA/Hoja55
A60	1051 bytes	VBA/Hoja56
A61	1051 bytes	VBA/Hoja57
A62	1051 bytes	VBA/Hoja58
A63	1051 bytes	VBA/Hoja59
A64	1134 bytes	VBA/Hoja6
A65	1051 bytes	VBA/Hoja60
A66	1051 bytes	VBA/Hoja61
A67	1051 bytes	VBA/Hoja62
A68	1051 bytes	VBA/Hoja63
A69	1051 bytes	VBA/Hoja64
A70	1051 bytes	VBA/Hoja65
A71	1051 bytes	VBA/Hoja66
A72	1051 bytes	VBA/Hoja67
A73	1051 bytes	VBA/Hoja68
A74	1051 bytes	VBA/Hoja69
A75	1239 bytes	VBA/Hoja7
A76	1051 bytes	VBA/Hoja70
A77	1051 bytes	VBA/Hoja71
A78	1051 bytes	VBA/Hoja72
A79	1051 bytes	VBA/Hoja73
A80	1240 bytes	VBA/Hoja74
A81	1232 bytes	VBA/Hoja75
A82	1967 bytes	VBA/Hoja76
A83	1127 bytes	VBA/Hoja77
A84	1050 bytes	VBA/Hoja8
A85	1050 bytes	VBA/Hoja9
A86	1240 bytes	VBA/ThisWorkbook
A87	14175 bytes	VBA/UserForm1
A88	22208 bytes	VBA/_VBA_PROJECT
A89	20071 bytes	VBA/__SRP_0
A90	2628 bytes	VBA/__SRP_1
A91	398 bytes	VBA/__SRP_10
A92	2098 bytes	VBA/__SRP_11
A93	438 bytes	VBA/__SRP_12
A94	258 bytes	VBA/__SRP_13
A95	249 bytes	VBA/__SRP_14
A96	156 bytes	VBA/__SRP_15
A97	594 bytes	VBA/__SRP_16
A98	774 bytes	VBA/__SRP_17
A99	394 bytes	VBA/__SRP_18
A100	182 bytes	VBA/__SRP_19
A101	250 bytes	VBA/__SRP_1a
A102	182 bytes	VBA/__SRP_1b
A103	464 bytes	VBA/__SRP_1c
A104	106 bytes	VBA/__SRP_1d
A105	9628 bytes	VBA/__SRP_1e
A106	756 bytes	VBA/__SRP_1f
A107	464 bytes	VBA/__SRP_2
A108	4427 bytes	VBA/__SRP_20
A109	424 bytes	VBA/__SRP_21
A110	464 bytes	VBA/__SRP_22
A111	106 bytes	VBA/__SRP_23
A112	464 bytes	VBA/__SRP_24
A113	106 bytes	VBA/__SRP_25
A114	464 bytes	VBA/__SRP_26
A115	106 bytes	VBA/__SRP_27
A116	106 bytes	VBA/__SRP_28
A117	464 bytes	VBA/__SRP_29
A118	106 bytes	VBA/__SRP_3
A119	680 bytes	VBA/__SRP_4
A120	106 bytes	VBA/__SRP_5
A121	1836 bytes	VBA/__SRP_6
A122	410 bytes	VBA/__SRP_7
A123	2210 bytes	VBA/__SRP_8
A124	356 bytes	VBA/__SRP_9
A125	742 bytes	VBA/__SRP_a
A126	258 bytes	VBA/__SRP_b
A127	464 bytes	VBA/__SRP_c
A128	106 bytes	VBA/__SRP_d
A129	1632 bytes	VBA/__SRP_e
A130	21690 bytes	VBA/__SRP_f
A131	4765 bytes	VBA/clsEventosForm
A132	11102 bytes	VBA/consultas
A133	3518 bytes	VBA/dir
A134	2310 bytes	VBA/filtros
A135	22972 bytes	VBA/mod_genera_formulario
A136	2088 bytes	VBA/mod_ia
A137	49832 bytes	VBA/mod_informes
A138	10915 bytes	VBA/mod_insumos
A139	8972 bytes	VBA/mod_listas_formulario
A140	2342 bytes	VBA/mod_load_ribbon
A141	2705 bytes	VBA/mod_utilidades
A142	4330 bytes	VBA/nuevosItems

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	btnBuscar_Click	Runs when the file is opened and ActiveXobjects trigger events
AutoExec	Worksheet_Change	Runs when the file is opened and ActiveXobjects trigger events
String		code and P-code are different, this may havebeen used to hide malicious code
Suspicious	CreateObject	May create an OLE object
Suspicious	CallByName	May attempt to obfuscate malicious functioncalls
Suspicious	VBProject	May attempt to modify the VBA code (self-modification)
Suspicious	VBComponents	May attempt to modify the VBA code (self-modification)
Suspicious	CodeModule	May attempt to modify the VBA code (self-modification)
Suspicious	AddFromString	May attempt to modify the VBA code (self-modification)
Suspicious	Hex Strings	Hex-encoded strings were detected, may beused to obfuscate strings (option --decode tosee all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may beused to obfuscate strings (option --decode tosee all)

Intelligence

File Origin

# of uploads :

# of downloads :

210

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/5da0bf22-1023-4465-8abc-15c03d994fca/

Malware family:

n/a

ID:

File name:

xlsm

Verdict:

No threats detected

Analysis date:

2026-06-24 08:14:31 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0ec96210-4c49-46dd-a134-09efbdb0f637

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

File type:

application/octet-stream

Has a screenshot:

False

Contains macros:

False

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/71801/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3b914186bc95245bf90dfd

Tags:

n/a

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Result

Verdict:

Malicious

File Type:

Excel File with Macro

Link:

https://app.docguard.net/d5c9b643b5c7e4f1ca90f8f6ccaeb24f681441ce9fecbe5154416ad661143b2e/results/dashboard

Behaviour

BlacklistAPI detected

Document image

Image:

Download PNG

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

evasive macros macros-on-event

Link:

https://www.filescan.io/uploads/6a3b91394dca8c24a5968d66/reports/c4c5fe06-9b06-4480-85bd-5d42f015f192/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d5c9b643b5c7e4f1ca90f8f6ccaeb24f681441ce9fecbe5154416ad661143b2e

Label:

Benign

Suspicious Score:

/10

Score Malicious:

Score Benign:

Link:

https://www.malware.ai/gui/files/?id=cd83a6b6-1fd6-4048-aa2c-9ad7a1fea34f

Verdict:

Clean

File Type:

xlsm

Link:

https://opentip.kaspersky.com/d5c9b643b5c7e4f1ca90f8f6ccaeb24f681441ce9fecbe5154416ad661143b2e/results?tab=lookup

Result

Threat name:

n/a

Detection:

suspicious

Classification:

evad

Score:

26 / 100

Link:

https://www.joesandbox.com/analysis/1933032

Signature

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Behaviour

Behavior Graph:

Download SVG

Score:

91%

Verdict:

Malware

File Type:

OFFICE

Link:

https://malprob.io/report/d5c9b643b5c7e4f1ca90f8f6ccaeb24f681441ce9fecbe5154416ad661143b2e

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d5c9b643b5c7e4f1ca90f8f6ccaeb24f681441ce9fecbe5154416ad661143b2e/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/d5c9b643b5c7e4f1ca90f8f6ccaeb24f681441ce9fecbe5154416ad661143b2e

Threat name:

Document.Trojan.Heuristic

Status:

Malicious

First seen:

2026-06-24 08:13:27 UTC

File Type:

Document

Extracted files:

706

AV detection:

3 of 38 (7.89%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2xe3mq5vy7spdsuq7d3mzlvsj5ubiqoot7wl4ukuifvnmyiuhmxa._file

Result

Malware family:

n/a

Score:

8/10

Tags:

macro

Link:

https://tria.ge/reports/260624-j3k2xsaz3y/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/d5c9b643b5c7e4f1ca90f8f6ccaeb24f681441ce9fecbe5154416ad661143b2e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	vbaproject_bin Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/71801/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample