Office (OOXML) / .XLSM malware analysis — malicious · 19408d64c6df49e5

MALICIOUS

Office (OOXML) / .XLSM

39.8 KB Created: 2022-06-14 07:34:15 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-06-14

MD5: cf850d35ca73d2f7565ff71628c1b620 SHA-1: e845a6c76e6a987f892f420e07398262cebc908b SHA-256: 19408d64c6df49e57cc05ff83c79662eb7aa138823c32b1945cec79d823150ce

88 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer

The critical heuristic 'OLE_VBA_DOWNLOAD' indicates the use of URLDownloadToFileA, a common function for downloading second-stage payloads. The VBA script explicitly declares this function, confirming its intent to download content from a URL. The presence of VBA macros also aligns with T1059.005. The document body contains obfuscated text, likely to evade static analysis.

Heuristics 3

URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `3a261aeaf3241dfa83d986e2cb7375c8bc853018536bdd0c2eeb56f7267e99e2`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	10418 bytes
`vbaProject_00.bin` `332fef2c8110291c9f0c320058d3cf7524c466580eb22ff15dc0300398599ef7`	vba-project	OOXML VBA project: xl/vbaProject.bin	37888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.