Ldridex Office (OOXML) / .XLSX malware analysis — malicious · 2fcf2db06c1c8149

MALICIOUS

Office (OOXML) / .XLSX

32.4 KB Created: 2020-09-30 12:37:26 UTC Authoring application: Microsoft Excel 16.0300

MD5: 1163c5754d5b8290e3b6d9d46aad988c SHA-1: 5ab33f846c2bdad87a7040f71279d6be3baf04c7 SHA-256: 2fcf2db06c1c8149aa89d3dc2c671130a5599e236e2cd4c37125e99a490aeae3

140 Risk Score

Malware Insights

Ldridex · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is detected as Ldridex malware by ClamAV, and heuristics indicate the presence of VBA macros within the OOXML document. The obfuscated document body suggests a social engineering attempt to trick the user into enabling macros, which would then likely be used to download and execute a second-stage payload. The ClamAV detection name 'Xls.Malware.Ldridex-9769692-0' strongly suggests the Ldridex family.

Heuristics 3

ClamAV: Xls.Malware.Ldridex-9769692-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Ldridex-9769692-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `969c6a424b8042e4572c9a2a0c581234098254ab871ff852b3711202213082bb`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	2635 bytes
`vbaProject_00.bin` `310189cb1bf002dc0657e21084a00ca43fec265417c822f37119a6a38bfda9e2`	vba-project	OOXML VBA project: xl/vbaProject.bin	22528 bytes
Detection ClamAV: Xls.Malware.Ldridex-9769692-0 Obfuscation or payload: unlikely
`emf_00.emf` `97242581bb30baf4365e0e27afd7cebb16fd5e5dac58943d3a8b3146b9500f46`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	9596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.