Office (OOXML) / .XLSM malware analysis — malicious · 297fa628e174f62e

MALICIOUS

Office (OOXML) / .XLSM

332.5 KB Created: 2019-06-17 17:48:55 UTC Authoring application: Microsoft Excel 12.0000

MD5: 86c63e5a375f54c79cfa007828400a5d SHA-1: 858168c7285d60d905470d70c32962a1367ea947 SHA-256: 297fa628e174f62edfc8ecf1e4ec79d8f177fe89308a0c04a0b55693af0a776f

168 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

This XLSM file contains a Workbook_Open macro that is triggered automatically when the document is opened. The macro uses Shell() to execute a payload, likely downloaded or constructed from environment variables and other obfuscated data within the spreadsheet. The obfuscation makes it difficult to determine the exact nature of the payload or its destination, but the intent is clearly to execute arbitrary code.

Heuristics 5

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `e5ba102fb1ec817992384c670a4c219ae693eb4392e124f429446f64fc05fd9c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1042 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `be3638c5e6874b89a8f186d8a9ba7d75e002bb7f45e734d90d371bac6004a8bb`	vba-project	OOXML VBA project: xl/vbaProject.bin	9216 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.