Office (OOXML) / .XLSM malware analysis — malicious · 2ea1d86f48ac4d38

MALICIOUS

Office (OOXML) / .XLSM

219.6 KB Created: 2021-05-07 12:30:36 UTC Authoring application: Microsoft Excel 15.0300

MD5: 3d0704fed94d48905669c6a6ceaa9872 SHA-1: de095053384c7e1e33fd4ac090cba8db0e3d9a47 SHA-256: 2ea1d86f48ac4d38454b3c56d04781afd37e5bc0e394fd84df3e0d3418024f86

248 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an XLSM file containing VBA macros, specifically a Workbook_Open macro, which is a common delivery mechanism for malware. The script utilizes CreateObject to instantiate objects like MSXML2.XMLHTTP and ADODB.Stream to download a payload from one of the embedded URLs. It also uses Wscript.Shell and rundll32.exe, indicating it attempts to execute the downloaded content. The ClamAV detection further confirms its malicious nature as a downloader.

Heuristics 8

ClamAV: Xls.Downloader.TrendMicroDridex0521-9860965-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.TrendMicroDridex0521-9860965-0
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND

Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://2nub.es/lib/js/prettyphoto/images/prettyPhoto/DDndV1TI5lvC3M7.php
- https://cartoonist.me.uk/wp-content/plugins/jetpack/scss/_utilities/us1svv7BFHAuE.php
- https://sportsfort.com.pk/wp-content/themes/porto/scss/plugins/cH1xmIuywQD.php
- https://aaftab.org/wp-content/plugins_/td-composer/td-multi-purpose/css/jPar115kAGV.php
- https://super-menu.it/includes/lib/HTMLPurifier/standalone/HTMLPurifier/wNYWKg4fYdO.php
- https://jajainfo.net/zm/wp-content/uploads/2013/06/b4KjNHHVq5p.php
- https://certifica.app.infoweb.boatcover.org/dt_091901820028/condivise/immagini/icone/icone-default-on/2NJsNm1KQuTMMVo.php
- https://theaccentchairs.com/wp-content/plugins/woocommerce/vendor/automattic/rWohwKVhOY7IPnR.php

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `e0e1a9b89be771e919ef84f342e6c7dbf721d34507da6fd93ef37846f8210c39`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	42295 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `968e2a35283fee680a7bcd58157c814f23495fa4e263e9b62b3c4612e394fc55`	vba-project	OOXML VBA project: xl/vbaProject.bin	263680 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.