Office (OLE) / .XLSX malware analysis — malicious · 054d32f119d8fa26

MALICIOUS

Office (OLE) / .XLSX

38.0 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel First seen: 2023-09-18

MD5: a0939fe019485426ee55b070d62b7352 SHA-1: 91f72bafb5ef1e7992f8b99aef2b67467fdafb53 SHA-256: 054d32f119d8fa26a040842ebf7e523a4f7203037cb42238490bbdbaf69dbb4d

160 Risk Score

Malware Insights

MITRE ATT&CK

T1547.001 Registry Run Keys / Startup Folder T1547.001 Registry Run Keys / Startup Folder T1059.005 Visual Basic

The sample is an Excel file containing VBA macros, specifically an Auto_Open macro. This macro is designed to copy the workbook to the Excel startup directory (XLSTART) as 'mypersonnel.xls', thereby establishing persistence. It also attempts to hide the main Excel window during this process. The Auto_Close macro attempts to convert the file to an older XLS format and delete the original XLSX, further obfuscating its presence. The ClamAV detection confirms its malicious nature.

Heuristics 4

ClamAV: Xls.Malware.ExcelSic-10004731-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.ExcelSic-10004731-1
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d49b3eed57ea333340314eacd5bf3454f6a2ba3085f3bfa723034dd1a2d97cfb`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1510 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.