Office (OOXML) malware analysis — malicious · 32a55b07fc7aba6a

MALICIOUS

Office (OOXML)

59.7 KB Created: 2016-12-09 10:21:12 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-07-24

MD5: 70083368620262d0ddef2c19f33f9134 SHA-1: 4904b41339572ca00fdffe9c099e049f41d8945e SHA-256: 32a55b07fc7aba6a319e835c54096dd034c3859a5c48db3ce0e8375f78a45507

200 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic

This Excel document contains embedded OLE objects, and critically, one of these objects contains a VBA macro project. The presence of a macro project strongly suggests that the document is designed to execute malicious code upon opening, likely through a spearphishing attachment vector. The ClamAV detection further supports its malicious nature.

Heuristics 3

ClamAV: Doc.Macro.Injection-6355574-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Macro.Injection-6355574-0
Embedded Office object carries macros critical OFFICE_EMBEDDED_MACRO_OBJECT

This document embeds a second Office file that itself contains a VBA macro project or an Excel 4.0 (XLM) macro sheet. Hiding a macro-bearing workbook or document inside another document — frequently under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way.
Embedded OLE object medium OOXML_OLE_OBJECT

Document contains an embedded OLE object

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`ooxml_oleobject_00.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/Microsoft_Excel_Worksheet.xlsx	45082 bytes
SHA-256: `397fc306b6a1aa8ac070cc97b5918b9447136bdee9b9acdf7a82cee84e2e049d`
Detection ClamAV: Doc.Macro.Injection-6355574-0 Obfuscation or payload: unlikely
`ooxml_oleobject_01.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/Microsoft_Excel_Worksheet.xlsx!xl/embeddings/Microsoft_Excel_Worksheet.xlsx	29988 bytes
SHA-256: `468ddaf679a3b7da8ef8d4ebfa8e00d3ad938a31a5b097f8b2499844a1d12a83`
Detection ClamAV: Doc.Macro.Injection-6355574-0 Obfuscation or payload: unlikely
`ooxml_oleobject_02.bin`	ooxml-ole-object	OOXML embedded OLE part: xl/embeddings/Microsoft_Excel_Worksheet.xlsx!xl/embeddings/Microsoft_Excel_Worksheet.xlsx!xl/embeddings/Microsoft_Excel_Macro-Enabled_Worksheet.xlsm	17428 bytes
SHA-256: `0e6209f8f91d9bcc2953672ca7910e44df7539d1118321d599d75b6c900a5b4c`
Detection ClamAV: Doc.Macro.Injection-6355574-0 Obfuscation or payload: unlikely
`emf_00.emf`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	50972 bytes
SHA-256: `13cd756bc5a28c6e44d1da81dbe64053a07f03b9a01380052808fca9dae9f8a1`

Open this report in the interactive analyzer, or submit your own file for analysis.