Ldridex Office (OOXML) / .XLSM malware analysis — malicious · 2c57cdeb19386882

MALICIOUS

Office (OOXML) / .XLSM

26.7 KB Created: 2020-09-23 11:00:17 UTC Authoring application: 16.0300

MD5: afa78afb7e8f2f47d8fc0d308abfb0bb SHA-1: 1ef3a820447080a44f5bd96f7c94c9c8e6765d3c SHA-256: 2c57cdeb1938688244dcaf05544e47daef28a6cec2866a674df9b6a4ed45237a

140 Risk Score

Malware Insights

Ldridex · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an XLSM document, and heuristics indicate the presence of VBA macros. ClamAV signatures identify it as Ldridex. The document body contains heavily obfuscated text, suggesting an attempt to disguise malicious content and trick the user into enabling macros. The primary intent appears to be macro execution for downloading and running a secondary payload, consistent with Ldridex behavior.

Heuristics 3

ClamAV: Xls.Malware.Ldridex-9769692-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Ldridex-9769692-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ebf3ed88191d48fbdd7477b0b2c4a4a974334759102b43734cb9abb6fb2a7128`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2427 bytes
`vbaProject_00.bin` `bc463a2f0904a094c6030fc333a571fbf9a5b4b505c05d130397a65b6a8a97cd`	vba-project	OOXML VBA project: xl/vbaProject.bin	22528 bytes
Detection ClamAV: Xls.Malware.Ldridex-9769692-0 Obfuscation or payload: unlikely
`emf_00.emf` `6eaee228b2d68bd7846c2d1f05f330a85a9e1d6eb60f74b8ec7337b6e04fd31c`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	2408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.