Office (OOXML) / .XLSX malware analysis — malicious · 24092e5b10b2dd67

MALICIOUS

Office (OOXML) / .XLSX

65.5 KB Created: 2022-09-20 07:24:03 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-09-20

MD5: 39e211582339251cc9769e6b84bed9e4 SHA-1: 234a9ad39cb37bc9da7e0ccc435a2a10091af726 SHA-256: 24092e5b10b2dd678f8143a0fb43515e7e7fded3f578237d30c230e74b3928cd

88 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer

The critical heuristic 'OLE_VBA_DOWNLOAD' indicates the use of URLDownloadToFileA within the VBA macro, a common technique for downloading secondary payloads. The presence of VBA macros, confirmed by the 'OOXML_VBA' heuristic, further supports this. The macro attempts to download a file from a URL, which is then likely executed, constituting an ingress tool transfer.

Heuristics 3

URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `0f6398755668acff99ab07b3695ce6c4f9a8fa87d7304e1f17966737d53ebcac`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	10512 bytes
`vbaProject_00.bin` `d8744a50702aef64a447672e8fe7d1bc9c236bc502b1ee2c1e603ebb4897b906`	vba-project	OOXML VBA project: xl/vbaProject.bin	40960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.