Office (OOXML) / .XLSM malware analysis — malicious · 3935f817a4a3b045

MALICIOUS

Office (OOXML) / .XLSM

437.0 KB Created: 2021-07-28 10:37:27 UTC Authoring application: Microsoft Excel 12.0000

MD5: d75f1076e0683bbd6e45c9a3ba89319a SHA-1: 137d2ef3200f78bc34e34226e4797ec7a18720a1 SHA-256: 3935f817a4a3b045aff7806d1a8ee5db42b1f35d9fb44898a065b0639cc81e8e

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell

The sample is an XLSM file containing a Workbook_Open macro, which is a common technique for executing malicious code upon opening. The macro uses CreateObject to execute a command. It constructs a file path using Environ() and Cells() functions, writes obfuscated content to this file, and then executes it. The specific command executed is not fully reconstructible due to reliance on cell values, but the overall pattern suggests a downloader or initial execution stage.

Heuristics 5

Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `bad49f85303b0598a98015535096954682deaee494a19e81d5f19ba673fe0999`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1127 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `f9943dfdd69e278f753170245cbb800614c1bf59b83540ad0df6e5081e4b4d28`	vba-project	OOXML VBA project: xl/vbaProject.bin	9216 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.