Malicious Office (OOXML) / .XLSM — malware analysis report

Heuristics 8

• NOP sled detected high SC_NOP_SLED
  Found 20+ consecutive 0x90 bytes
• Workbook_Open macro high OLE_VBA_WBOPEN
  Workbook_Open macro
• GetObject call high OLE_VBA_GETOBJ
  GetObject call
• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
• VBA project inside OOXML medium OOXML_VBA
  Document contains a VBA project — VBA macros present
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
• External hyperlinks (1) low OOXML_EXTERNAL_HYPERLINKS
  Document contains 1 external hyperlink — clickable URLs are stored as external relationships. First target: https://www.vertex42.com/ExcelTemplates/quote-template.html
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://www.purequestair.co.za/

  • https://www.vertex42.com/ExcelTemplates/quote-template.html
  • https://www.vertex42.com/licensing/EULA_privateuse.html
  • https://www.vertex42.com/ExcelArticles/invoicing.html

Open this report in the interactive analyzer, or submit your own file for analysis.