Office (OOXML) / .XLSX malware analysis — malicious · 1dfd0e94efad34fc

MALICIOUS

Office (OOXML) / .XLSX

60.6 KB Created: 2006-10-11 04:02:12 UTC Authoring application: WPS Office 12.0000

MD5: d091532e65e2995b48170832e7590b4a SHA-1: b4f21809b2c0dd3ed24b5078f10645def58a0098 SHA-256: 1dfd0e94efad34fc4f7c476791ee34fefd358a968fe53c5e84e2dc025be7e439

108 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.005 Visual Basic

The sample is an OOXML document containing VBA macros, indicated by the 'OOXML_VBA' and 'EXTRACTED_FILE_STATIC_TRIAGE' heuristics. The 'SE_INVOICE_LURE' heuristic and the document body content suggest the file is designed to appear as an invoice. The presence of VBA macros, along with the external relationship heuristic pointing to a local file path, suggests the macro may be intended to execute malicious code or download further payloads, potentially related to the invoice lure.

Heuristics 4

External relationship high OOXML_EXTERNAL_REL

External target in xl/externalLinks/_rels/externalLink2.xml.rels: file:///\\Sskim\최종선적현황\7-9BUY\HS VINA 7-9BUY 최종선적분.xls
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d7fcb38dade46b874c531345313cc1be4c02f67cc0438b613bb81ef85a8e22c9`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2316 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s).
`vbaProject_00.bin` `b4cfa11de6e0660bde466437cda101b22d918368f09b2600a3ddc2d8cc7cb32d`	vba-project	OOXML VBA project: xl/vbaProject.bin	16896 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.