Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 32d52214cf5e988f…

MALICIOUS

Office (OLE) / .XLSX

799.5 KB Created: 2021-06-14 10:44:34 Authoring application: Microsoft Excel
MD5: 76d9ad731b3417ce329035c3497d19eb SHA-1: 8e1ccb1aa620255a8205fbb44e705472b2fc9e93 SHA-256: 32d52214cf5e988fcea03d7edc9f775b22da0a886c75f37ceebd9a0b054a1391
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample is an Excel file containing a Workbook_Open VBA macro that utilizes Shell() and CreateObject() calls. This indicates the macro is designed to execute arbitrary commands, likely to download and run a secondary payload. The presence of an appended OLE payload further supports this malicious intent.

Heuristics 9

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
    OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
    URL https://agafarma���3�����2M
    • https://S1N���vk��\��
    • https://ex2G}2����wp��e)F
    • https://agafarmameninodeus.com.br/loja/wp-includes/sodium_compat/namespaced/Core/QznYUjHXl0IUi8.php|=IUaGch,/3gJ!N4
    • https://www.patie.com.br/posts/hPdcXys\2V^5hUEfG.php
    • https://highend.p
    • https://damta.mrboatstudio.com/wp-content/plugins/elementor/includes/admin-templates/8sgSD2JtRBnm1.php
    • https://at.amcashzen.q;J1(com/wp-content/plugins/op-builder/tests/pages/UR1Z8SOGQX3uvir.php
    • https://edulogy.goweb%j4rKkkart.com/images/pretty%j4rKkP%j4rKkhoto/dark_r%j4rKkounded/i4fyLMdIm%j4rKk4x.php
    • https://S1^Kc7S1^Kc7finS1^Kc7al.foS1^Kc7odpoint.ma/publS1^Kc7ic/impactfront/vendor/bootstrap/dist/MbvBb3r7S3ARV.php
    • https://exam.edumation.app/wp-c0%18RgS0%18RgSontent/themes/twentynineteen/sass/blocks/4bcHpcgYlJKPDXl.php
    • https://goodiesmariage.e-m2.net/wp-content/themes/a-one/woocommerce/global/pV8mYVETWrj.php3yr%E68wwDm,O+

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
a10b9f668bb8aba306ab73dde7cf8e17102946db48c9cb8c88e92c6ae188c6db		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 122012 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.