Office (OOXML) / .XLSM malware analysis — malicious · 1e921bbadfa1efdd

MALICIOUS

Office (OOXML) / .XLSM

43.4 KB Created: 2020-07-01 11:19:42 UTC Authoring application: Microsoft Excel 16.0300

MD5: 22a3d596c43a62669f67483798c82c3c SHA-1: b6045c58ad0b595601469c613fbb69cc849b8525 SHA-256: 1e921bbadfa1efdd857ee47646adb30b9f845533d65f46f0c95ce7a70511bae1

200 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell T1059.001 PowerShell

The sample is an XLSM file containing VBA macros. Heuristics indicate the use of Shell(), WScript.Shell, and CreateObject, suggesting the VBA code is designed to execute arbitrary commands. The presence of 'macros.bas' and 'vbaProject_00.bin' further supports macro execution. The VBA code likely downloads and executes a second-stage payload, as indicated by the critical heuristics.

Heuristics 5

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ae3f0be97437b25388a1a9b6555e53fadac61437c036451c5d57a2600d8b6072`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1129 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).
`vbaProject_00.bin` `f72afb5fcbb721a892c6bd14992e47f2dc0931a2aadca74ddbfd20d5b9d9196c`	vba-project	OOXML VBA project: xl/vbaProject.bin	15360 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).
`emf_00.emf` `76754ba0a3e20c57e0dcf10f001a5968d80dce96762bd4662dd82c751411a472`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	3432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.