Rule Info
Name
SUSP_VBA_Dropper_Feb26
Author
MalGamy
Description
Detects malicious VBA macros implementing string obfuscation and used to drop malicious payloads
Score
70
Date
2026-02-20
Minimum Yara
3.5.0
Rule Hash
c571e66327fc13a7e41632a729def58a
Tags
['SCRIPT', 'OBFUS', 'SUSP']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
2
Suspicious (< 10 engines)
4
Clean (0 engines)
0
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR