Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 0a30b8e187cc828e…

MALICIOUS

Office (OOXML) / .XLSM

1.79 MB Created: 2013-01-08 22:43:30 UTC Authoring application: Microsoft Excel 12.0000
MD5: 25f56826c5f16ce409d23ac69af900b9 SHA-1: 1b64d6a8fe68a66fc63794817acbf527845869f0 SHA-256: 0a30b8e187cc828e900bb238b8912cdb5eda5ba11f2368f685c58bb1f74f7088
442 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1140 Deobfuscate or Obfuscate Malicious Code

This XLSM file contains a Workbook_Open macro that is heavily obfuscated and uses WScript.Shell and CreateObject to execute commands. The presence of `OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER` and `OLE_VBA_ACTIVEX_XLM_STAGER` heuristics indicates a loader designed to deobfuscate and execute further malicious code, likely a second-stage payload. The `SE_CALLBACK_LURE` heuristic suggests a potential social engineering pretext, though the document body itself is generic project metadata.

Heuristics 12

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    The compiled VBA p-code (identifier table) references an auto-firing ActiveX/control event together with ExecuteExcel4Macro, while the decompressed source does not — the VBA-stomping shape of the ActiveX-event XLM stager. The control event bridges into XLM formula execution to call Win32 / drop payloads, hidden from source-level scanners.
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.clinigengroup.com
    • http://www.xtm-intl.com/resources?f=xtm-offline-editor
    • https://xtm-intl.com/xtm-offline-editor
    • https://xtm-intl.com/xtm-offline-editor$
    • http://www.allaboutcookies.org
    • http://tools.google.com/dlpage/gaoptout

Extracted artifacts 16

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
ec740d5d4a414bdbffe9859c6d1e4dcd0f0091b2c3d9c7d08a9002350c4b98ef		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 424899 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
ooxml_oleobject_00.bin
aeab5286072a60d50d43d5dadd95796f4dfb0bdf54750ae27e07f36c9be50cf3		 ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 927232 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
ooxml_oleobject_00_ole10native_00.bin
333eeb45e1caeb372d0cb31d5c7c6c5835ce8521a5b913eed9b23311c73501af		 ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 918101 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.99, consistent with packed or encrypted content.
vbaProject_00.bin
7644dde9330ac8264de1346ef2b25205e4dba22ed4b525f6fc52cb7d6e84f306		 vba-project OOXML VBA project: xl/vbaProject.bin 920064 bytes
emf_00.emf
d8f5cc26892c9e2f5d81ee7bc9c3d749250a5caf5a46cac55e3f8a54e1a41cd6		 ooxml-emf OOXML EMF part: xl/media/image8.emf 7064 bytes
emf_01.emf
5957d0aad537f1290434f1c49070acbce0d1bca05519ad00bc33eaa3037445d6		 ooxml-emf OOXML EMF part: xl/media/image9.emf 7064 bytes
emf_02.emf
255d447fcf385b06de2029e4331a29f07038c4217a50b36ad13b9cde679cdb79		 ooxml-emf OOXML EMF part: xl/media/image10.emf 3444 bytes
emf_03.emf
6d0945132c32c4c75ebdfc785ddf1821f1321221474b7206703ee73ea09f9e9a		 ooxml-emf OOXML EMF part: xl/media/image7.emf 3444 bytes
emf_04.emf
c89618797009a0dc4350cfcd96c07d8717c528f96788ce1fff5e662482cb7fa1		 ooxml-emf OOXML EMF part: xl/media/image6.emf 3444 bytes
emf_05.emf
c5e11d73d00c0da64953e649977b5bde8398bfce8b07b0da838fc563204b1ccc		 ooxml-emf OOXML EMF part: xl/media/image5.emf 3444 bytes
emf_06.emf
2450df5a158278ac88fee2b79500b65f24ad1c2e0a469a43dcc56582c60a637a		 ooxml-emf OOXML EMF part: xl/media/image4.emf 3444 bytes
emf_07.emf
27d97f6ac0ebbc677f840ee791e28c3ea7cf3ba33a6289368e64b32e8abccf80		 ooxml-emf OOXML EMF part: xl/media/image3.emf 7064 bytes
emf_08.emf
8a91fb61e0ebdd06a5be13b860cf0137fac23aad7c217e1fadf3a2d4e314f172		 ooxml-emf OOXML EMF part: xl/media/image2.emf 3444 bytes
emf_09.emf
1d64b454093f872529e2b08d101b0cb6d51ba9815b1eb86149c123de6b464c1a		 ooxml-emf OOXML EMF part: xl/media/image12.emf 1136 bytes
emf_10.emf
f164c286dcb36cbb6d0664d7229494711f9f1d3921b91a29cde5cc29fbb53657		 ooxml-emf OOXML EMF part: xl/media/image13.emf 5064 bytes
emf_11.emf
82632685a925b5505cada783d35154f4cd0870630a312705c154059ce2c253b3		 ooxml-emf OOXML EMF part: xl/media/image11.emf 3444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.