Office (OOXML) / .XLSM malware analysis — malicious · 33a26b8911b3aaa0

MALICIOUS

Office (OOXML) / .XLSM

282.2 KB Created: 2012-12-12 21:56:02 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2025-03-07

MD5: f9d16b1f5f8124c76a57cb35ec189088 SHA-1: 5342f13f9be7e6a990b65b845688b972a5f9dc6a SHA-256: 33a26b8911b3aaa0373d8f4b941b91892bd165c9f9a56f38c83bec7917bcd3e1

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.005 Visual Basic T1140 Deobfuscate/Decode Files or Information

The sample is an Excel macro-enabled document (XLSM) containing a Workbook_Open macro, indicating it's designed to execute code upon opening. The document body presents a 'Royal Mail Account Inland Claim Form', a common lure for phishing or scam operations. The presence of hidden worksheets and the SE_CALLBACK_LURE heuristic further support a social engineering attack, likely aiming to trick users into providing sensitive details or making fraudulent claims.

Heuristics 5

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
VBA project inside OOXML medium OOXML_VBA

Document contains a VBA project — VBA macros present
Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 3 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `f2e610137105a4ef2bdf03f89e6257998bce0fcd32e2cd10ae128f1484c19aaf`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	20720 bytes
`vbaProject_00.bin` `e0dc20810e6f142697283d2f17b1987c159a44c111dbb7bfdd14007d3dfb8b2c`	vba-project	OOXML VBA project: xl/vbaProject.bin	476672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.