Dridex Office (OOXML) / .XLSM malware analysis — malicious · 28977cd312c41e8e

MALICIOUS

Office (OOXML) / .XLSM

809.3 KB Created: 2021-05-10 16:23:19 UTC Authoring application: Microsoft Excel 15.0300

MD5: bff3376643c19abaec12de924b31ea81 SHA-1: fc886a226660ae0423b24c5171cbcc5f60a0fbc1 SHA-256: 28977cd312c41e8ebdf5c7089a8e3d76d37c8551fdd9a9c32191ecea23f3c2d8

248 Risk Score

Malware Insights

Dridex · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

The presence of a Workbook_Open macro, CreateObject calls, and a visible LOLBin command execution instruction strongly indicates malicious intent. The macro likely uses MSXML2.XMLHTTP and ADODB.Stream to download a payload from one of the provided URLs, and Wscript.Shell or rundll32.exe to execute it. The ClamAV detection as Xls.Downloader.TrendMicroDridex0521-9860965-0 further supports the Dridex family attribution and the downloader functionality.

Heuristics 8

ClamAV: Xls.Downloader.TrendMicroDridex0521-9860965-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.TrendMicroDridex0521-9860965-0
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND

Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://test651.estore.vlinkhosting.com/QhX2IwPp5Tsl.php
- https://sincroniasdelalma-new.srcomputadoras.com/wp-content/themes/twentynineteen/template-parts/content/S1tU7zL7RBAfK.php
- https://nellyfunerals.co.za/VKzdkfe8ufv.php
- https://vorsocmart.com/jVdoyxAE.php
- https://beta.hairshow.pt/Xkjfx6qv.php
- https://sellobsoleteinventories.com/images/favicon/0mJUsyWM8dOk6.php
- https://quicklane.ae/llKTfaRKu9cHNme.php
- https://meskot.org/wp-content/plugins/litespeed-cache/src/cdn/0Rek020ky.php
- https://auroralatinohomecare.com/wp-content/plugins/fusion-builder/templates/content/D7Ll4so2BJz4J.php
- https://kuwaitiurologist.com/beta/vendor/dnoegel/php-xdg-base-dir/src/VVWhvoXcz.php

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `6fb004fc7acc5a770054a9c6e6e1d84fc7de0ff8ddb06d8e6c745741988beb33`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	438658 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `16e2ddd2e2954951b87f135480c7cafc13505ecf7239bda18611f077a6cf0e2c`	vba-project	OOXML VBA project: xl/vbaProject.bin	973824 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.